NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)GHSA-39h7-pwv7-rc3x

GHSA-39h7-pwv7-rc3x is a security vulnerability in @excalidraw/excalidraw. A fix is available for @excalidraw/excalidraw — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of May 5, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

247other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@excalidraw/excalidrawnpm
1.3Mdownloads / week
@excalidraw/mermaid-to-excalidrawnpm
1.4Mdownloads / week

Description

Impact

@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/[email protected] by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

Patches

  • Stable @excalidraw/[email protected] is patched.
  • Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/[email protected] on 2025-08-21.
  • Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later.

Workarounds

None.

Resources

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npm@excalidraw/excalidraw≥ 0.18.0&&< 0.18.10.18.1npm install @excalidraw/excalidraw@0.18.1
📦npm@excalidraw/mermaid-to-excalidraw≥ 0.3.0&&< 1.1.31.1.3npm install @excalidraw/mermaid-to-excalidraw@1.1.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @excalidraw/excalidraw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @excalidraw/excalidraw to 0.18.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-39h7-pwv7-rc3x is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact `@excalidraw/[email protected]` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched in `@excalidraw/[email protected]` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release. Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists b
O3 Security · Impact-Aware SCA

Is GHSA-39h7-pwv7-rc3x in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Excalidraw vulnerable to XSS via Mermaid sequence…