CVE-2025-54881
1 advisory.
npm/mermaid CVE-2025-54881: medium, EPSS 0.80%
Mermaid improperly sanitizes sequence diagram labels leading to XSS
Action: Upgrade mermaid to 10.9.4 or later.
npm i mermaid@11.10.0npm i mermaid@10.9.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0-alpha.1 | 11.10.0 | - |
| 10.9.0-rc.1 | 10.9.4 | - |
Fixed versions
| 11.10.0 | 10.9.4 |
Sources
- osv: GHSA-7rqq-prvp-x9jh
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- https://nvd.nist.gov/vuln/detail/CVE-2025-54881
- https://github.com/mermaid-js/mermaid/commit/5c69e5fdb004a6d0a2abe97e23d26e223a059832
- https://github.com/mermaid-js/mermaid/commit/685516a85ec1df64cefd4fd15f26533be87d458e
- https://github.com/mermaid-js/mermaid
CVE-2025-54881 · published · modified · JSON