CVE-2026-71437
Received Received - Intake

Mermaid Architecture Diagram Prototype Pollution via __proto__

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of __proto__. Because the group id is used directly as an object property key without validation, an attacker who can supply diagram text can pollute Object.prototype, potentially affecting the behavior of the embedding application. This issue is fixed in version 11.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-71437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mermaid mermaid to 11.16.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mermaid versions 11.5.0 to 11.16.1 are vulnerable to prototype pollution. An attacker can exploit this by defining a group with an id of __proto__ in a diagram. This allows them to modify Object.prototype, which can alter the behavior of the embedding application.

Detection Guidance

This vulnerability affects Mermaid versions 11.5.0 to 11.16.1. To detect it, check the installed version of Mermaid in your environment using commands like npm list mermaid or checking the version in package.json. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

If you use Mermaid in your application, an attacker could manipulate the application's behavior by polluting Object.prototype. This might lead to unexpected code execution, data leaks, or application crashes, depending on how the application handles user input.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations must ensure their systems are patched to avoid compliance violations.

Mitigation Strategies

Upgrade Mermaid to version 11.16.1 or later immediately. If using npm, run npm update mermaid or npm install mermaid@latest. Review any user-provided diagram inputs to ensure they do not contain malicious group ids like __proto__.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart