Description
In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting.
Recommendation
Update the mermaid package to the latest compatible version. Followings are version details:
- Affected version(s): >= 11.1.0, < 11.10.0
- Patched version(s): 11.10.0
References
Could your website be exposed too?
SmartScanner can check your website for Mermaid does not properly sanitize architecture diagram iconText leading to XSS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base - CVE-2025-53892
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core - CVE-2025-53892
You might also like:
See something that needs correcting? Let us knowUpdated August 20, 2025