Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw

Description

@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/[email protected] by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Recommendation

Update the @excalidraw/mermaid-to-excalidraw package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.3.0, < 1.1.3
• Patched version(s): 1.1.3

References

• GHSA-39h7-pwv7-rc3x
• CWE-1395
• CWE-79
• OWASP 2021-A3