Excalidraw XSS in Mermaid sequence diagram labels via KaTeX

Severity: info · CVSS 6.1 · Published 2026-04-24

Excalidraw is a popular open-source virtual whiteboard used for creating hand-drawn-like diagrams. When users paste Mermaid sequence diagrams with malicious labels into the editor, the application fails to properly sanitize user input before rendering it through KaTeX, allowing attackers to inject and execute arbitrary JavaScript code. This requires the attacker to trick a user into pasting a specially crafted diagram, but once executed, the XSS can steal session data or perform actions on the user's behalf.

Technologies: Excalidraw, @excalidraw/excalidraw (npm). Vendors: Excalidraw, npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, with a CVSS score of 6.1, published 24 April 2026.
Which products and versions are affected?
Excalidraw 0.18.0; Excalidraw Mermaid-To-Excalidraw >= 0.3.0, < 1.1.3, >=0.3.0, <1.1.3; @excalidraw/excalidraw (npm) SEMVER:introduced=0.18.0,fixed=0.18.1; @excalidraw/mermaid-to-excalidraw (npm) SEMVER:introduced=0.3.0,fixed=1.1.3.
Is there a fix for This vulnerability?
Yes. @excalidraw/excalidraw (npm): upgrade to 0.18.1 or later; @excalidraw/mermaid-to-excalidraw (npm): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run Excalidraw, Excalidraw Mermaid-To-Excalidraw, @excalidraw/excalidraw (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @excalidraw/excalidraw (npm): upgrade to 0.18.1 or later
    npm install @excalidraw/excalidraw@0.18.1
  • @excalidraw/mermaid-to-excalidraw (npm): upgrade to 1.1.3 or later
    npm install @excalidraw/mermaid-to-excalidraw@1.1.3

Technical details

This is a Cross-Site Scripting (XSS) vulnerability in the Mermaid-to-Excalidraw conversion pipeline. The root cause lies in Mermaid's calculateMathMLDimensions function, which passes unsanitized sequence diagram node labels directly to innerHTML after KaTeX rendering, bypassing the content security model. An attacker can craft a Mermaid diagram with labels containing HTML/JavaScript payloads (e.g., &lt;img src="x" onerror="..."&gt;) that execute when the diagram is imported into Excalidraw. The attack requires manual user action—pasting the malicious diagram into the editor—but has no additional preconditions. Excalidraw 0.18.0 is affected; the fix is available in 0.18.1 and later by updating the @excalidraw/mermaid-to-excalidraw dependency to version 2.2.2, which uses a patched Mermaid release.

Affected products

  • Excalidraw @excalidraw/excalidraw 0.18.0
  • Excalidraw @excalidraw/mermaid-to-excalidraw >=0.3.0, <1.1.3

Timeline

  • 2026-04-24: disclosed: GHSA-39h7-pwv7-rc3x published
  • 2026-04-21: patched: @excalidraw/excalidraw 0.18.1 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.