Bug 2389505 (CVE-2025-54881) - CVE-2025-54881 mermaid: Mermaid cross site scripting
Summary: CVE-2025-54881 mermaid: Mermaid cross site scripting
Keywords:
Status: NEW
Alias: CVE-2025-54881
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2389816 2389818 2389820 2389822 2389824 2389826 2389832 2389834 2389836 2389844 2389810 2389812 2389814 2389828 2389830 2389838 2389840 2389842
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-08-19 18:04 UTC by OSIDB Bzimport
Modified: 2025-08-21 15:09 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-08-19 18:04:40 UTC 
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.
Note You need to log in before you can comment on or make changes to this bug.