GHSA-39h7-pwv7-rc3x

Suggest an improvement
Source
https://github.com/advisories/GHSA-39h7-pwv7-rc3x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-39h7-pwv7-rc3x/GHSA-39h7-pwv7-rc3x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-39h7-pwv7-rc3x
Published
2026-04-24T20:41:51Z
Modified
2026-05-05T16:02:23Z
Summary
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Details

Impact

@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

Patches

  • Stable @excalidraw/excalidraw@0.18.1 is patched.
  • Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/excalidraw@0.18.0-f29edf on 2025-08-21.
  • Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later.

Workarounds

None.

Resources

Database specific 
{
    "cwe_ids":  [
        "CWE-1395",
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-24T20:41:51Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / @excalidraw/excalidraw

Package

Name
@excalidraw/excalidraw
View open source insights on deps.dev
Purl
pkg:npm/%40excalidraw/excalidraw

Affected ranges

Type
SEMVER
Events
Introduced
0.18.0
Fixed
0.18.1

Affected versions

0.*
0.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-39h7-pwv7-rc3x/GHSA-39h7-pwv7-rc3x.json"

npm / @excalidraw/mermaid-to-excalidraw

Package

Name
@excalidraw/mermaid-to-excalidraw
View open source insights on deps.dev
Purl
pkg:npm/%40excalidraw/mermaid-to-excalidraw

Affected ranges

Type
SEMVER
Events
Introduced
0.3.0
Fixed
1.1.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-39h7-pwv7-rc3x/GHSA-39h7-pwv7-rc3x.json"