Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@excalidraw/mermaid-to-excalidraw

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

    GHSA-39h7-pwv7-rc3x

    Affected
    • npm @excalidraw/mermaid-to-excalidraw >= 0.3.0, < 1.1.3
    Fixed in
    1.1.3· Vendor fix available
    Issue
    Impact @excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release. Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link). Patches - Stable @excalidraw/excalidraw@0.18.1 is patched. - Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/excalidraw@0.18.0-f29edf on 2025-08-21. - Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later. Workarounds None. Resources - Upstream Mermaid advisory:…

    Recommended action: Upgrade to 1.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →