CVE-2025-54880

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54880
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc Patch
https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4 Product
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw Vendor Advisory Exploit Patch
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw Vendor Advisory Exploit Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:*
History

20 Oct 2025, 15:12

Type Values Removed Values Added
References () https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc - () https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc - Patch
References () https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4 - () https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4 - Product
References () https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw - () https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw - Vendor Advisory, Exploit, Patch
First Time Mermaid Project
Mermaid Project mermaid
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:node.js:*:*

20 Aug 2025, 14:40

Type Values Removed Values Added
Summary
  • (es) Mermaid es una herramienta de diagramación y gráficos basada en JavaScript que utiliza definiciones de texto inspiradas en Markdown y un renderizador para crear y modificar diagramas complejos. En la configuración predeterminada de Mermaid 11.9.0 y versiones anteriores, la información proporcionada por el usuario para los iconos de los diagramas de arquitectura se pasa al método html() de d3, lo que crea un receptor para cross site scripting. Esta vulnerabilidad se corrigió en la versión 11.10.0.

19 Aug 2025, 18:15

Type Values Removed Values Added
References () https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw - () https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw -

19 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-19 17:15

Updated : 2025-10-20 15:12

NVD link : CVE-2025-54880

Mitre link : CVE-2025-54880

CVE.ORG link : CVE-2025-54880

JSON object : View

Products Affected

mermaid_project

  • mermaid
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')