GHSA-39H7-PWV7-RC3X: DOM-based XSS in Excalidraw via Mermaid Diagram Rendering Vulnerability ID: GHSA-39H7-PWV7-RC3X CVSS Score: 7.5 Published: 2026-04-24 Excalidraw suffers from a DOM-based Cross-Site Scripting (XSS) vulnerability caused by an upstream flaw in the Mermaid diagramming library. The issue occurs during the dimension calculation of KaTeX-rendered labels, leading to arbitrary JavaScript execution when a malicious diagram is rendered in the browser. TL;DR DOM-based XSS in Excalidraw resulting from un-sanitized KaTeX label rendering in the upstream Mermaid engine.…