CVE-2026-71438

Received Received - Intake

Prototype Pollution in Mermaid Diagram Tool

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71438

Affected Vendors & Products

Vendor	Product	Version / Range
mermaid	mermaid	to 10.9.8 (inc)
mermaid	mermaid	to 11.16.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability affects Mermaid, a JavaScript tool for creating diagrams. It involves prototype pollution in configuration setters like mermaid.initialize. The issue occurs when untrusted data is passed directly into these setters, merging with internal config. Fixed in versions 10.9.8 and 11.16.1.

Detection Guidance

This vulnerability is specific to applications using Mermaid's configuration setters with untrusted data. Detection requires checking if your application passes user-controlled input directly to mermaid.initialize, mermaidAPI.setConfig, or mermaidAPI.updateSiteConfig. Review application code for these calls.

Impact Analysis

If you use Mermaid in an application that forwards untrusted data into configuration setters, an attacker could manipulate the prototype chain. This may lead to unintended behavior, data leaks, or application crashes. Diagram-supplied config is not affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is limited to prototype pollution in Mermaid's configuration setters when untrusted data is forwarded into them, which is outside documented usage. No evidence suggests this impacts data protection or privacy requirements.

Mitigation Strategies

Upgrade Mermaid to version 10.9.8 or later, or 11.16.1 or later. Avoid passing untrusted data directly into configuration setters. Use diagram-supplied configuration methods instead.

Hi! I’m here to help you understand CVE-2026-71438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70