CVE-2025-54880: fallo de gravedad media en mermaid-js mermaid
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.4%
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
mermaid-js · mermaidCVEs relacionadas — mermaid-js mermaid
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-43861HIGHIncorrect sanitisation function leads to `XSS`EPSS 0.9%CVE-2022-31108MEDIUMArbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsEPSS 0.9%CVE-2025-54881MEDIUMMermaid improperly sanitizes of sequence diagram labels leading to XSSEPSS 0.8%CVE-2026-50159MEDIUMMermaid allows CSS injection applying to sibling elements of the diagramEPSS 0.6%CVE-2026-71436MEDIUMMermaid XY Charts are vulnerable to an infinite loop DoSEPSS 0.6%CVE-2026-71439MEDIUMMermaid radar diagrams are vulnerable to DoSEPSS 0.5%