Is CVE-2025-54880 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54880 being exploited in the wild.

How severe is CVE-2025-54880?

Medium severity, with a CVSS score of 4, published 19 August 2025.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=11.1.0,fixed=11.10.0.

Is there a fix for CVE-2025-54880?

Yes. mermaid (npm): upgrade to 11.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54880 attacked?

It is attacked over the network.

Am I affected by CVE-2025-54880?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54880: Mermaid improper sanitization of architecture diagram iconText leading to XSS

CVE-2025-54880 · Severity: medium · CVSS 4 · Published 2025-08-19

Mermaid is a JavaScript library used to render diagrams from text descriptions on websites. The architecture diagram feature fails to sanitize user-supplied text for icon labels, allowing attackers to inject malicious HTML and JavaScript code. When a website displays user-created or user-controlled diagrams without additional protections, an attacker can execute arbitrary JavaScript in visitors' browsers, potentially stealing session data, credentials, or performing actions on behalf of the victim.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2025-54880 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54880 being exploited in the wild.
How severe is CVE-2025-54880?: Medium severity, with a CVSS score of 4, published 19 August 2025.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=11.1.0,fixed=11.10.0.
Is there a fix for CVE-2025-54880?: Yes. mermaid (npm): upgrade to 11.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54880 attacked?: It is attacked over the network.
Am I affected by CVE-2025-54880?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.10.0 or later
```
npm install mermaid@11.10.0
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw introduced in Mermaid v11.1.0 and present through v11.9.0. The architecture diagram rendering code passes the `iconText` parameter directly to the d3 `html()` method via `.html(service.iconText)`, which treats the input as raw HTML rather than escaped text. No validation or sanitization occurs on this user-controlled input before insertion into the DOM. The attack is network-reachable and requires no authentication, but does require user interaction to render a malicious diagram. An attacker can craft a diagram containing JavaScript payloads in the iconText field that execute in the browser context. The vulnerability was patched in version 11.10.0.

Affected products

Mermaid Mermaid 11.1.0 through 11.9.0

Identifiers

CVE-2025-54880
GHSA-8gwm-58g9-j8pw

Timeline

2025-08-19: disclosed
2025-08-19: patched: Fixed in version 11.10.0

References

https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.