VULNERABILITY INTELLIGENCE

CVE-2025-54880

CVSS score5.1 MEDIUM

EPSS probability0.41%

CISA KEVNot currently listed

Published2025-08-19

Last modified2026-06-17

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Product
security-advisories@github.com — Exploit, Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Patch, Vendor Advisory