fix(deps): update dependency @excalidraw/excalidraw to v0.18.1 [security] #6

Merged

oss merged 1 commit from renovate/npm-excalidraw-excalidraw-vulnerability into selfhost

2026-11-14 20:59:47 +01:00

renovate-bot commented

2026-11-06 04:06:07 +01:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
@excalidraw/excalidraw (source)	`0.18.0` → `0.18.1`

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

GHSA-39h7-pwv7-rc3x

More information

Details

Impact

@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

Patches

Stable @excalidraw/excalidraw@0.18.1 is patched.
Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/excalidraw@0.18.0-f29edf on 2025-08-21.
Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later.

Workarounds

None.

Resources

Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
CVE-2025-54881

Severity

Moderate

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

excalidraw/excalidraw (@excalidraw/excalidraw)

`v0.18.1`

Compare Source

Security patch release for @excalidraw/excalidraw@0.18.x, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh.

Backports Mermaid XSS mitigation by updating @excalidraw/mermaid-to-excalidraw to 2.2.2
Pins @types/d3-dispatch for compatibility with the 0.18.x TypeScript version

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@excalidraw/excalidraw](https://github.com/excalidraw/excalidraw/tree/master/packages/excalidraw) ([source](https://github.com/excalidraw/excalidraw)) | [`0.18.0` → `0.18.1`](https://renovatebot.com/diffs/npm/@excalidraw%2fexcalidraw/0.18.0/0.18.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@excalidraw%2fexcalidraw/0.18.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@excalidraw%2fexcalidraw/0.18.0/0.18.1?slim=true) | --- ### Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) [GHSA-39h7-pwv7-rc3x](https://github.com/advisories/GHSA-39h7-pwv7-rc3x) <details> <summary>More information</summary> #### Details ##### Impact `@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path. This is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release. Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link). ##### Patches - Stable `@excalidraw/excalidraw@0.18.1` is patched. - Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21. - Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later. ##### Workarounds None. ##### Resources - Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh - CVE-2025-54881 #### Severity Moderate #### References - [https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x](https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x) - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh) - [https://github.com/excalidraw/excalidraw](https://github.com/excalidraw/excalidraw) - [https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1](https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-39h7-pwv7-rc3x) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>excalidraw/excalidraw (@excalidraw/excalidraw)</summary> ### [`v0.18.1`](https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1) [Compare Source](https://github.com/excalidraw/excalidraw/compare/v0.18.0...v0.18.1) Security patch release for `@excalidraw/excalidraw@0.18.x`, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. - Backports Mermaid XSS mitigation by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2` - Pins `@types/d3-dispatch` for compatibility with the 0.18.x TypeScript version </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-11-06 04:06:07 +01:00

fix(deps): update dependency @excalidraw/excalidraw to v0.18.1 [security]

upkeep / dispatch (pull_request_target) Failing after 30m10s

Details

976c868423