{"action":"Upgrade mermaid to 11.10.0 or later.","affected":[{"fixed":"11.10.0","introduced":"11.1.0"}],"component":"mermaid","cve_ids":["CVE-2025-54880"],"ecosystem":"npm","epss":0.0039,"exploited":false,"fixed_versions":["11.10.0"],"ghsa_id":"GHSA-8gwm-58g9-j8pw","id":"tcs_01M5KFD05PTQRMVJK2B3DH48PB","modified_at":"2026-08-07T08:12:20.025979274Z","published_at":"2025-08-19T20:16:45Z","references":["https://osv.dev/vulnerability/GHSA-8gwm-58g9-j8pw","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw","https://nvd.nist.gov/vuln/detail/CVE-2025-54880","https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc","https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4","https://github.com/mermaid-js/mermaid"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8gwm-58g9-j8pw","url":"https://osv.dev/vulnerability/GHSA-8gwm-58g9-j8pw"},{"source":"nvd","source_id":"CVE-2025-54880","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54880"}],"summary":"Mermaid does not properly sanitize architecture diagram iconText leading to XSS"}