GHSA-39h7-pwv7-rc3x: @excalidraw/excalidraw Cross-Site Scripting Vulnerability

MODERATE
Share
CWE-1395 CWE-79
Published
Advisory Summary

GHSA-39h7-pwv7-rc3x is a MODERATE cross-site scripting vulnerability (CWE-1395: Dependency on Vulnerable Third-Party Component) affecting @excalidraw/excalidraw libraries in the npm ecosystem. The issue involves excalidraw vulnerable to xss via mermaid sequence diagram labels (katex rendering). Remediation is available by upgrading affected packages to version 0.18.1, 1.1.3.

GHSA-39h7-pwv7-rc3x at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-39h7-pwv7-rc3x
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-1395: Dependency on Vulnerable Third-Party Component
Affected Product @excalidraw/excalidraw
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-39h7-pwv7-rc3x

To remediate this vulnerability, upgrade all affected @excalidraw/excalidraw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@excalidraw/excalidraw fixed: 0.18.1 
npm install @excalidraw/excalidraw@0.18.1
@excalidraw/mermaid-to-excalidraw fixed: 1.1.3 
npm install @excalidraw/mermaid-to-excalidraw@1.1.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @excalidraw/excalidraw

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-39h7-pwv7-rc3x, inspect your project dependencies using npm:

npm ls @excalidraw/excalidraw

Analyze the terminal output to locate any version of @excalidraw/excalidraw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.18.1), your application is affected.

Note: The npm ls @excalidraw/excalidraw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1395: Dependency on Vulnerable Third-Party Component, where the product has a dependency on a third-party component that contains one or more known vulnerabilities. In @excalidraw/excalidraw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact `@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release. Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link). ### Patches - Stable `@excalidraw/excalidraw@0.18.1` is patched. - Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21. - Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later. ### Workarounds None. ### Resources - Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh - CVE-2025-54881

GHSA-39h7-pwv7-rc3x Affected @excalidraw/excalidraw Versions

2 component(s)
Fixed Versions:
0.18.11.1.3
Product / Package Ecosystem Affected Versions Fixed Version
@excalidraw/excalidraw
npm/@excalidraw/excalidraw
npm
≥ 0.18.0
< 0.18.1
All 1 versions
0.18.0
0.18.1
@excalidraw/mermaid-to-excalidraw
npm/@excalidraw/mermaid-to-excalidraw
npm
≥ 0.3.0
< 1.1.3
1.1.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x
GitHub Advisory / Wiki ADVISORY
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
@excalidraw/excalidraw Source Repository REPOSITORY
https://github.com/excalidraw/excalidraw
@excalidraw/excalidraw Release RELEASE
https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1

Frequently Asked Questions

What is GHSA-39h7-pwv7-rc3x?
GHSA-39h7-pwv7-rc3x is a security vulnerability in @excalidraw/excalidraw involving Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) under CWE-1395: Dependency on Vulnerable Third-Party Component.
Which @excalidraw/excalidraw versions are affected?
Affected versions include releases prior to 0.18.1, 1.1.3 across affected packages: @excalidraw/excalidraw, @excalidraw/mermaid-to-excalidraw.
What version fixes GHSA-39h7-pwv7-rc3x?
Upgrading to 0.18.1, 1.1.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @excalidraw/excalidraw affected?
Yes, @excalidraw/excalidraw is affected in releases prior to 0.18.1. Upgrade your dependency to 0.18.1 or later.
Is @excalidraw/mermaid-to-excalidraw affected?
Yes, @excalidraw/mermaid-to-excalidraw is affected in releases prior to 1.1.3. Upgrade your dependency to 1.1.3 or later.
What CWE is associated with GHSA-39h7-pwv7-rc3x?
GHSA-39h7-pwv7-rc3x is classified under CWE-1395: Dependency on Vulnerable Third-Party Component (The product has a dependency on a third-party component that contains one or more known vulnerabilities.).
How can I check npm dependencies for GHSA-39h7-pwv7-rc3x?
Run the dependency tree command: 'npm ls @excalidraw/excalidraw'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-39h7-pwv7-rc3x",
  "modified" : "2026-04-24T20:41:51Z",
  "published" : "2026-04-24T20:41:51Z",
  "aliases" : [ ],
  "summary" : "Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)",
  "details" : "### Impact\n\n`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.\n\nThis is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.\n\nModerate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).\n\n### Patches\n\n- Stable `@excalidraw/excalidraw@0.18.1` is patched.\n- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.\n- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.\n\n### Workarounds\n\nNone.\n\n### Resources\n\n- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\n- CVE-2025-54881",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@excalidraw/excalidraw"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.18.0"
      }, {
        "fixed" : "0.18.1"
      } ]
    } ],
    "versions" : [ "0.18.0" ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@excalidraw/mermaid-to-excalidraw"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.3.0"
      }, {
        "fixed" : "1.1.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/excalidraw/excalidraw"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1395", "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-24T20:41:51Z",
    "nvd_published_at" : null
  }
}