Mermaid does not properly sanitize architecture diagram iconText leading to XSS

Description

In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.1.0, < 11.10.0
• Patched version(s): 11.10.0

References

• GHSA-8gwm-58g9-j8pw
• CVE-2025-54880
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 3 - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 4 - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) - CVE-2025-53892

Tags:

npm

mermaid