Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Impact
@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.
This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.
Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).
Patches
- Stable
@excalidraw/excalidraw@0.18.1is patched. - Unstable
@excalidraw/excalidraw@nexthas resolved to patched builds since@excalidraw/excalidraw@0.18.0-f29edfon 2025-08-21. - Direct consumers of
@excalidraw/mermaid-to-excalidrawshould use1.1.3or later.
Workarounds
None.
Resources
- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- CVE-2025-54881
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @excalidraw/excalidraw | >= 0.18.0, < 0.18.1 | 0.18.1 |
| Paquete de npm | @excalidraw/mermaid-to-excalidraw | >= 0.3.0, < 1.1.3 | 1.1.3 |
Referencias
- Debilidad (CWE)
CWE-1395, CWE-79- Plataforma
- npm
- Paquete
@excalidraw/excalidraw, @excalidraw/mermaid-to-excalidraw- Publicada
- 24.04.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-39h7-pwv7-rc3x - CC BY 4.0
Historial de vulnerabilidades: @excalidraw/mermaid-to-excalidraw
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.