# What changed in @excalidraw/excalidraw

> 2 changes in @excalidraw/excalidraw 0.18 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@excalidraw/excalidraw/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @excalidraw/excalidraw 0.18

### Security

- Backports a Mermaid XSS mitigation to address CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. (0.18.1) — [release notes](https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1)
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) (0.18.1) — [security advisory](https://github.com/advisories/GHSA-39H7-PWV7-RC3X)