Mermaid does not properly sanitize architecture diagram iconText leading to XSS

Description

In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.1.0, < 11.10.0
• Patched version(s): 11.10.0

References

• GHSA-8gwm-58g9-j8pw
• CVE-2025-54880
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 5 - CVE-2025-27597
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 4 - CVE-2025-27597

Tags:

npm

mermaid