Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Impact
@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.
This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.
Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).
Patches
- Stable
@excalidraw/excalidraw@0.18.1is patched. - Unstable
@excalidraw/excalidraw@nexthas resolved to patched builds since@excalidraw/excalidraw@0.18.0-f29edfon 2025-08-21. - Direct consumers of
@excalidraw/mermaid-to-excalidrawshould use1.1.3or later.
Workarounds
None.
Resources
- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- CVE-2025-54881
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @excalidraw/excalidraw | >= 0.18.0, < 0.18.1 | 0.18.1 |
| npm package | @excalidraw/mermaid-to-excalidraw | >= 0.3.0, < 1.1.3 | 1.1.3 |
References
- Weakness (CWE)
CWE-1395, CWE-79- Platform
- npm
- Package
@excalidraw/excalidraw, @excalidraw/mermaid-to-excalidraw- Disclosed
- 24.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-39h7-pwv7-rc3x - CC BY 4.0
Vulnerability history: @excalidraw/excalidraw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 08.2023 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 3
Disclosures per year
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 1
-
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.