Description
In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.
Recommendation
Update the mermaid package to the latest compatible version. Followings are version details:
Affected version(s): **>= 10.9.0-rc.1, < 10.9.4 >= 11.0.0-alpha.1, < 11.10.0** Patched version(s): **10.9.4 11.10.0**
References
Could your website be exposed too?
SmartScanner can check your website for Mermaid improperly sanitizes sequence diagram labels leading to XSS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw - Vulnerability
- OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") - CVE-2026-32308
You might also like:
See something that needs correcting? Let us knowUpdated September 04, 2025