N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-39h7-pwv7-rc3x

GHSA-39h7-pwv7-rc3x: Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Impact

@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

Patches

Stable @excalidraw/excalidraw@0.18.1 is patched.
Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/excalidraw@0.18.0-f29edf on 2025-08-21.
Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later.

Workarounds

None.

Resources

Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
CVE-2025-54881

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-39h7-pwv7-rc3x

GHSA-39h7-pwv7-rc3x:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@excalidraw/excalidraw	npm	= 0.18.0	0.18.1
@excalidraw/mermaid-to-excalidraw	npm	>= 0.3.0, < 1.1.3	1.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in a dependency, @excalidraw/mermaid-to-excalidraw, which in turn uses a vulnerable version of the Mermaid.js library. The patch for this vulnerability is to update the dependency to a version that includes the fix for the upstream XSS. The analysis of the patch commit identified the functions in the Excalidraw codebase that are responsible for handling Mermaid diagram data and passing it to the vulnerable dependency. Specifically, the App.onPaste method is the entry point for pasted content, and the convertMermaidToExcalidraw function is used by the 'Text to Diagram' feature. Both of these functions call the vulnerable parseMermaidToExcalidraw function from the @excalidraw/mermaid-to-excalidraw package. Therefore, these two functions are the primary runtime indicators that would appear in a profiler or stack trace when this vulnerability is exploited.

Vulnerable functions

App.onPaste

packages/excalidraw/components/App.tsx

This function handles paste events in the Excalidraw editor. When a user pastes text identified as a Mermaid diagram, this function calls `api.parseMermaidToExcalidraw` from the vulnerable `@excalidraw/mermaid-to-excalidraw` package. A malicious Mermaid diagram could then trigger the XSS vulnerability during parsing and rendering.

convertMermaidToExcalidraw

packages/excalidraw/components/TTDDialog/common.ts

This function is used by the 'Text to Diagram' feature. It takes user-supplied text, intended to be a Mermaid diagram definition, and passes it to `api.parseMermaidToExcalidraw` from the vulnerable `@excalidraw/mermaid-to-excalidraw` package. A malicious Mermaid diagram definition provided by the user could trigger the XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.