{"action":"Upgrade mermaid to 10.9.4 or later.","affected":[{"fixed":"11.10.0","introduced":"11.0.0-alpha.1"},{"fixed":"10.9.4","introduced":"10.9.0-rc.1"}],"component":"mermaid","cve_ids":["CVE-2025-54881"],"ecosystem":"npm","epss":0.00799,"exploited":false,"fixed_versions":["11.10.0","10.9.4"],"ghsa_id":"GHSA-7rqq-prvp-x9jh","id":"tcs_01M5KFAWTNCJCEC6AJ5BV2NPGY","modified_at":"2026-08-07T08:12:11.518764754Z","published_at":"2025-08-19T20:16:58Z","references":["https://osv.dev/vulnerability/GHSA-7rqq-prvp-x9jh","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh","https://nvd.nist.gov/vuln/detail/CVE-2025-54881","https://github.com/mermaid-js/mermaid/commit/5c69e5fdb004a6d0a2abe97e23d26e223a059832","https://github.com/mermaid-js/mermaid/commit/685516a85ec1df64cefd4fd15f26533be87d458e","https://github.com/mermaid-js/mermaid"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7rqq-prvp-x9jh","url":"https://osv.dev/vulnerability/GHSA-7rqq-prvp-x9jh"},{"source":"nvd","source_id":"CVE-2025-54881","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54881"}],"summary":"Mermaid improperly sanitizes sequence diagram labels leading to XSS"}