CVE-2025-54880: Mermaid Diagramming Tool XSS Vulnerability

CVE-2025-54880 Overview

CVE-2025-54880 is a cross-site scripting (XSS) vulnerability in Mermaid, a JavaScript-based diagramming and charting tool that renders diagrams from Markdown-inspired text definitions. In the default configuration of Mermaid version 11.9.0 and earlier, user-supplied input for architecture diagram icons is passed to the D3 html() method. That method interprets its argument as HTML, creating a sink for script injection. Any application that renders untrusted Mermaid architecture diagrams inherits the risk. The maintainers fixed the issue in version 11.10.0 by routing icon input through a sanitizer. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers who can control architecture diagram icon values can execute arbitrary JavaScript in the context of the rendering page, enabling session theft, defacement, and phishing.

Affected Products

Mermaid 11.9.0 and earlier (npm package mermaid)
Applications embedding vulnerable Mermaid builds that render user-supplied diagram source
Documentation platforms, wikis, and Markdown renderers that expose Mermaid architecture diagrams

Discovery Timeline

2025-08-19 - CVE-2025-54880 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54880

Vulnerability Analysis

Mermaid's architecture diagram renderer accepts an icon value for each service node. The renderer forwards that value to D3's selection.html() method, which parses and inserts the string as HTML into the SVG output. Because the icon value originates from diagram source that may be controlled by a document author or an untrusted input path, an attacker can supply markup that includes event handlers or embedded <script> payloads. The result is script execution in the origin that hosts the rendered diagram.

Exploitation requires user interaction (UI:P) and low privileges (PR:L), for example loading a page that renders an attacker-supplied diagram. Impact is scoped to the browser session, but a successful payload can steal authentication tokens, pivot into single-page application state, or redirect users to phishing infrastructure.

Root Cause

The root cause is the use of the D3 html() sink without prior sanitization of the icon field in packages/mermaid/src/diagrams/architecture/svgDraw.ts. The fix imports sanitizeText from the shared common.js module and applies it to icon-related input before it reaches the DOM.

typescript

 import { createText } from '../../rendering-util/createText.js';
 import { getIconSVG } from '../../rendering-util/icons.js';
 import type { D3Element } from '../../types.js';
+import { sanitizeText } from '../common/common.js';
 import type { ArchitectureDB } from './architectureDb.js';
 import { architectureIcons } from './architectureIcons.js';
// Source: https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc

Attack Vector

The attack vector is network-based and delivered through diagram source content. Any surface that renders a Mermaid architecture diagram from untrusted input, such as a Markdown comment, a pull request preview, a wiki page, or an issue tracker, may serve as the entry point. A payload embedded in the icon value of an architecture service definition triggers execution when the diagram is rendered.

typescript

-const addService = function ({ id, icon, in: parent, title }: Omit<ArchitectureService, "edges">) {
+const addService = function ({ id, icon, in: parent, title, iconText }: Omit<ArchitectureService, "edges">) {
   if (state.records.registeredIds[id] !== undefined) {
     throw new Error(`The service id [${id}] is already in use by another ${state.records.registeredIds[id]}`);
   }
// Source: https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4

Detection Methods for CVE-2025-54880

Indicators of Compromise

Mermaid architecture diagram source containing HTML tags, on* event attributes, or javascript: URIs inside icon fields
Unexpected outbound requests initiated from pages that render user-supplied Mermaid content
Client-side console errors referencing d3html() insertion of unexpected DOM nodes

Detection Strategies

Inventory JavaScript dependencies and flag any application resolving mermaid at version <= 11.9.0 in package-lock.json or yarn.lock
Scan stored diagram source in wikis, CMS databases, and repositories for architecture blocks whose icon: values contain angle brackets or script keywords
Enable browser Content Security Policy (CSP) reporting to catch inline script violations from rendered diagrams

Monitoring Recommendations

Monitor CSP violation reports and web application firewall logs for XSS patterns targeting endpoints that render Mermaid
Alert on user submissions to Markdown or diagram fields that include the architecture-beta directive combined with suspicious icon payloads
Track dependency graph changes through Software Composition Analysis tooling to confirm upgrades reach 11.10.0 or later

How to Mitigate CVE-2025-54880

Immediate Actions Required

Upgrade Mermaid to version 11.10.0 or later across all applications, build pipelines, and static site generators
Audit stored diagram content for existing malicious icon payloads and remove or neutralize them
Deploy or tighten a Content Security Policy that disallows inline script execution on pages rendering diagrams

Patch Information

The fix is delivered in Mermaid 11.10.0. The maintainers published a coordinated advisory at GHSA-8gwm-58g9-j8pw and merged the sanitization change in commit 2aa8330. A related node-labels change appears in commit 734bde3.

Workarounds

Disable rendering of architecture diagrams from untrusted sources until the upgrade is deployed
Pre-process diagram source server-side to strip HTML tags and event handlers from icon values before rendering
Sandbox the renderer inside an iframe served from a distinct origin with a strict CSP

bash

# Upgrade Mermaid to the patched release
npm install mermaid@^11.10.0

# Verify installed version
npm ls mermaid