Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Description

@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/[email protected] by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Recommendation

Update the @excalidraw/excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): = 0.18.0
• Patched version(s): 0.18.1

References

• GHSA-39h7-pwv7-rc3x
• CWE-1395
• CWE-79
• OWASP 2021-A3