Protip to anyone using Mermaid.js Don't. It's a sea shanty of XSS vulns. https://snyk.io/vuln/npm%3Amermaid
I thought it would have a parser that parses the submitted code to generate its own graph representation. there shouldn't be a chance for running js, no?