CVE-2025-54880CWE-79

Mermaid does not properly sanitize architecture diagram iconText leading to XSS

Medium · published August 19, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
32.0
In the wild
Unconfirmed
What it is

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00390 · 32.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-19T16:58Z
EPSS history
Timeline
  • 19 AUG 16:58Z
    Mermaid does not properly sanitize architecture diagram iconText leading to XSS
    cvelistv5