{"id":"GHSA-39h7-pwv7-rc3x","aliases":[],"status":"published","title":"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","description":"### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-79"],"published":"2026-04-24T20:41:51Z","modified":"2026-05-05T16:02:23Z","fixes":[{"ecosystem":"npm","package":"@excalidraw/excalidraw","fixed_in":["0.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@excalidraw/mermaid-to-excalidraw","fixed_in":["1.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@excalidraw/excalidraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0"},{"last_affected":"0.18.0"},{"fixed":"0.18.1"}]}],"versions":["0.18.0"]},{"source":"ghsa","ecosystem":"npm","package":"@excalidraw/mermaid-to-excalidraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@excalidraw/excalidraw","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.1"}]}],"versions":["0.18.0"]},{"source":"osv","ecosystem":"npm","package":"@excalidraw/mermaid-to-excalidraw","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"1.1.3"}]}]}],"references":[{"url":"https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x","tags":["web"]},{"url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh","tags":["web"]},{"url":"https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-39h7-pwv7-rc3x"},{"url":"https://github.com/excalidraw/excalidraw","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-39h7-pwv7-rc3x","title":"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","description":"### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881","status":"published","published":"2026-04-24T20:41:51Z","modified":"2026-04-24T20:41:54Z","cwes":["CWE-79","CWE-1395"],"updated_at":"2026-11-02T14:39:56.453138Z"}],"osv":[{"id":"GHSA-39h7-pwv7-rc3x","title":"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","description":"### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881","status":"published","published":"2026-04-24T20:41:51Z","modified":"2026-05-05T16:02:23.084098Z","cwes":["CWE-1395","CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}