Medium severity6.1NVD Advisory· Published Aug 19, 2025· Updated Jun 17, 2026
CVE-2025-54880
CVE-2025-54880
Description
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mermaidnpm | >= 11.1.0, < 11.10.0 | 11.10.0 |
Affected products
8- osv-coords7 versionspkg:apk/chainguard/langfusepkg:apk/chainguard/langfuse-compatpkg:apk/chainguard/langfuse-workerpkg:apk/wolfi/langfusepkg:apk/wolfi/langfuse-compatpkg:apk/wolfi/langfuse-workerpkg:npm/mermaid
< 3.102.0-r0+ 6 more
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: < 3.102.0-r0
- (no CPE)range: >= 11.1.0, < 11.10.0
- Range: >= 11.1.0, < 11.10.0
Patches
Vulnerability mechanics
References
5- github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fcnvdPatchWEB
- github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pwnvdExploitPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-8gwm-58g9-j8pwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-54880ghsaADVISORY
- github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4nvdProductWEB
News mentions
0No linked articles in our index yet.