PT-2025-33815 · Mermaid+1 · Mermaid+1

Fourcube · Published 2025-08-19 · Updated 2025-10-20 · CVE-2025-54880

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mermaid versions prior to 11.10.0

Description: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration, user-supplied input for architecture diagram icons is passed to the d3 html() method, creating a cross-site scripting sink.

Recommendations: Update to version 11.10.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54880

GHSA-8GWM-58G9-J8PW

Affected Products

Debian

Mermaid

References · 17

• 🔥 https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54880.json · Exploit
• https://github.com/mermaid-js/mermaid/commit/2aa83302795183ea5c65caec3da1edd6cb4791fc · Patch
• https://osv.dev/vulnerability/GHSA-8gwm-58g9-j8pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54880 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54880 · Security Note
• https://ubuntu.com/security/CVE-2025-54880 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-54880 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54880 · Security Note
• https://github.com/mermaid-js/mermaid · Note
• https://github.com/mermaid-js/mermaid/commit/734bde38777c9190a5a72e96421c83424442d4e4 · Note
• https://t.me/cveNotify/139397 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1957900215823786338 · Twitter Post
• https://twitter.com/eternalky_u/status/1957876505574514944 · Twitter Post