GHSA-39H7-PWV7-RC3X: DOM-based XSS in Excalidraw via Mermaid Diagram Rendering

Vulnerability ID: GHSA-39H7-PWV7-RC3X

CVSS Score: 7.5

Published: 2026-04-24

Excalidraw suffers from a DOM-based Cross-Site Scripting (XSS) vulnerability caused by an upstream flaw in the Mermaid diagramming library. The issue occurs during the dimension calculation of KaTeX-rendered labels, leading to arbitrary JavaScript execution when a malicious diagram is rendered in the browser.

TL;DR

DOM-based XSS in Excalidraw resulting from un-sanitized KaTeX label rendering in the upstream Mermaid engine.

Technical Details

CWE ID : CWE-79

Attack Vector : Network / Client-Side

Vulnerability Type : DOM-based Cross-Site Scripting (XSS)

Exploit Status : Proof of Concept Available

Upstream Root Cause : CVE-2025-54881

Affected Sink : innerHTML within calculateMathMLDimensions

Affected Systems

@excalidraw/excalidraw

@excalidraw/mermaid-to-excalidraw

mermaid

@excalidraw/excalidraw : <= 0.18.0 (Fixed in: 0.18.1…