{"id":"CVE-2025-54880","aliases":["GHSA-8gwm-58g9-j8pw"],"url":"https://o3.security/vulnerability/CVE-2025-54880","summary":"Mermaid does not properly sanitize architecture diagram iconText leading to XSS","details":"### Summary\nIn the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 `html()` method, creating a sink for cross site scripting.\n\n### Details\nArchitecture diagram service `iconText` values are passed to the d3 `html()` method, allowing malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration. \n\nThe vulnerability lies here:\n\n```ts\nexport const drawServices = async function (\n  db: ArchitectureDB,\n  elem: D3Element,\n  services: ArchitectureService[]\n): Promise<number> {\n  for (const service of services) {\n    /** ... **/\n    } else if (service.iconText) {\n      bkgElem.html(\n        `<g>${await getIconSVG('blank', { height: iconSize, width: iconSize, fallbackPrefix: architectureIcons.prefix })}</g>`\n      );\n      const textElemContainer = bkgElem.append('g');\n      const fo = textElemContainer\n        .append('foreignObject')\n        .attr('width', iconSize)\n        .attr('height', iconSize);\n      const divElem = fo\n        .append('div')\n        .attr('class', 'node-icon-text')\n        .attr('style', `height: ${iconSize}px;`)\n        .append('div')\n        .html(service.iconText); // <- iconText passed into innerHTML\n       /** ... **/\n};\n};\n```\n\nThis issue was introduced with 734bde38777c9190a5a72e96421c83424442d4e4, around 15 months ago, which was released in [v11.1.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.1.0).\n\n### PoC\nRender the following diagram and observe the modified DOM.\n\n```\narchitecture-beta\n    group api(cloud)[API]\n    service db \"<img src=x onerror=\\\"document.write(`xss on ${document.domain}`)\\\">\" [Database] in api\n```\n\nHere is a PoC on mermaid.live: https://mermaid.live/edit#pako:eNo9T8FOwzAM_ZXI4rBJpWrpRtuIISF24caZZdKyxOsiLUnlJjCo-u9kQ8wX-_n5-dkjKK8ROEhSRxNQhUh4v8cghWMpOvKxZ7I3M3XyUc83L-9v2z9qQPo0CpneMwFPxnZsILU6M--QyNNKCAHaq2jRhfyL0vLZ7jwMiWd3443Q3krjpt38Mv4sgG3WMsi9HHDLjLs4CwcZdGQ08EARM7BISZMgjJdLBIQjWhTAU6nxIOMpCBBuSrJeug_v7b8yPdMdgR_kaUgo9loGXBvZkbS3LqHTSK8-ugC8LMrrEuAjnIEvlnlVL9q6rZu6Lh-rRQbfwKuyyZuybcvqIaWiqKcMfq6uRd7Uy-kXhYFzcA\n\n### Impact\nXSS on all sites that use mermaid and render user supplied diagrams without further sanitization.\n\n### Remediation\nSanitize the value of `iconText` before passing it to `html()`.","published":"2025-08-19T16:58:41.120Z","modified":"2026-10-28T02:31:05.928087230Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mermaid","fixedVersion":"11.10.0"}],"fix":{"url":"https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc","label":"mermaid-js/mermaid@2aa8330"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54880.json"},{"type":"ADVISORY","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54880"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4"},{"type":"PACKAGE","url":"https://github.com/mermaid-js/mermaid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:05.928087230Z"}}