Executive brief
Excalidraw is a popular open-source virtual whiteboard used for creating hand-drawn-like diagrams. When users paste Mermaid sequence diagrams with malicious labels into the editor, the application fails to properly sanitize user input before rendering it through KaTeX, allowing attackers to inject and execute arbitrary JavaScript code. This requires the attacker to trick a user into pasting a specially crafted diagram, but once executed, the XSS can steal session data or perform actions on the user's behalf.
Technical details
This is a Cross-Site Scripting (XSS) vulnerability in the Mermaid-to-Excalidraw conversion pipeline. The root cause lies in Mermaid's calculateMathMLDimensions function, which passes unsanitized sequence diagram node labels directly to innerHTML after KaTeX rendering, bypassing the content security model. An attacker can craft a Mermaid diagram with labels containing HTML/JavaScript payloads (e.g., <img src="x" onerror="...">) that execute when the diagram is imported into Excalidraw. The attack requires manual user action—pasting the malicious diagram into the editor—but has no additional preconditions. Excalidraw 0.18.0 is affected; the fix is available in 0.18.1 and later by updating the @excalidraw/mermaid-to-excalidraw dependency to version 2.2.2, which uses a patched Mermaid release.
Affected products
- Excalidraw @excalidraw/excalidraw 0.18.0
- Excalidraw @excalidraw/mermaid-to-excalidraw >=0.3.0, <1.1.3
Timeline
- 2026-04-24: disclosed: GHSA-39h7-pwv7-rc3x published
- 2026-04-21: patched: @excalidraw/excalidraw 0.18.1 released with patch