GHSA-39h7-pwv7-rc3x Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Attackers can execute arbitrary JavaScript in Excalidraw by tricking users into pasting malicious Mermaid diagrams, requiring an upgrade to the patched library version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-39h7-pwv7-rc3x?
GHSA-39h7-pwv7-rc3x is a cross-site scripting vulnerability in @excalidraw/excalidraw, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.
This is patched in @excalidraw/[email protected] by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.
Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).
Patches
- Stable
@excalidraw/[email protected]is patched. - Unstable
@excalidraw/excalidraw@nexthas resolved to patched builds since@excalidraw/[email protected]on 2025-08-21. - Direct consumers of
@excalidraw/mermaid-to-excalidrawshould use1.1.3or later.
Workarounds
None.
Resources
- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- CVE-2025-54881
Which versions are affected by GHSA-39h7-pwv7-rc3x?
4 open source packages ship an affected version, including @excalidraw/excalidraw and @excalidraw/mermaid-to-excalidraw.
| Package | Affected | Fixed in |
|---|---|---|
@excalidraw/excalidraw npm | From 0.18.0 | 0.18.1 |
@excalidraw/excalidraw npm | From 0.18.0 | 0.18.1 |
@excalidraw/mermaid-to-excalidraw npm | From 0.3.0 | 1.1.3 |
@excalidraw/mermaid-to-excalidraw npm | From 0.3.0 | 1.1.3 |
How do I fix GHSA-39h7-pwv7-rc3x?
Upgrade @excalidraw/excalidraw to 0.18.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-39h7-pwv7-rc3x being exploited?
There is no known exploitation of GHSA-39h7-pwv7-rc3x in the wild and no public exploit code.