CVE-2025-54880 Mermaid does not properly sanitize architecture diagram iconText leading to XSS

What is CVE-2025-54880?

CVE-2025-54880 is a medium-severity cross-site scripting vulnerability in mermaid-js mermaid, published on 19 Aug 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

Weakness: CWE-79

Which versions are affected by CVE-2025-54880?

2 open source packages ship an affected version, including mermaid. It affects 1 product.

Products include Mermaid Project Mermaid.

How do I fix CVE-2025-54880?

Upgrade mermaid to 11.10.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-54880 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54880 exists.

Other vulnerabilities in mermaid-js mermaid

• CVE-2021-43861 Incorrect sanitisation function leads to `XSS` High 7.2
• CVE-2021-35513 Cross-site Scripting in Mermaid Medium 6.1
• CVE-2026-41150 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Medium 5.3
• CVE-2026-41159 Mermaid: Improper sanitization of configuration leads to CSS injection Medium 5.3
• CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js Medium 4.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8gwm-58g9-j8pw, UBUNTU-CVE-2025-54880.