CVE-2025-54880

Name	CVE-2025-54880
Description	Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-mermaid (PTS)	bullseye	8.7.0+ds+~cs27.17.17-3+deb11u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-mermaid	source	bullseye	(not affected)
node-mermaid	source	(unstable)	(unfixed)

[bullseye] - node-mermaid <not-affected> (Vulnerable code not present)
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw