mermaid-js — Vulnerabilities & Security Advisories 14

Mermaid-js is a JavaScript-based diagramming and charting tool that enables developers to create visualizations through text-based descriptions. Historically, it has been susceptible to cross-site scripting (XSS) vulnerabilities due to improper input sanitization in rendering functions, with several instances allowing remote code execution through malicious diagram definitions. The project has addressed multiple security flaws, including those enabling arbitrary code execution via crafted diagram syntax, though no major public security incidents have been documented. Despite these vulnerabilities, the tool remains widely adopted for documentation and visualization purposes, with ongoing efforts to improve security through input validation and sandboxed rendering environments.