CVE-2026-71438: Prototype Pollution in Mermaid Configuration APIs
Vulnerability ID: CVE-2026-71438
CVSS Score: 2.4
Published: 2026-08-06
Prior to versions 10.9.8 and 11.16.1, Mermaid is vulnerable to prototype pollution via its deep-merge utility function assignWithDepth. This helper is invoked by public configuration-setting interfaces, specifically mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig. Because assignWithDepth recursively merges developer-provided properties into Mermaid's internal configuration state without proper sanitization, an attacker who can control or influence the configuration payload can corrupt the global Object.prototype. This vulnerability can lead to security bypasses, cross-site scripting (XSS), or execution flow modifications in applications using vulnerable Mermaid integrations.
TL;DR
A prototype pollution vulnerability in Mermaid's deep-merge utility allowed global prototype corruption when processing untrusted configuration objects, resolved in patched versions via strict Object.hasOwn and Object.defineProperty checks.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1321
- Attack Vector: Local / Indirect via host configuration sink
- CVSS Score: 2.4 (Low)
- EPSS Score: 0.00043
- Impact: Security control bypass, global property modification
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Mermaid JS Library
- Applications dynamically initializing Mermaid with user-controlled configuration objects
-
mermaid: < 10.9.8 (Fixed in:
10.9.8) -
mermaid: >= 11.0.0-alpha.1, < 11.16.1 (Fixed in:
11.16.1)
Code Analysis
Commit: 2cd6dcf
Hardened assignWithDepth using Object.hasOwn and Object.defineProperty, deprecating setConfig API.
Commit: c34b07a
Backported assignWithDepth prototype pollution fix to v10 branch.
Exploit Details
- GitHub Security Advisory: Advisory containing theoretical exploitation guidelines and reproduction paths.
Mitigation Strategies
- Upgrade Mermaid to patched versions (10.9.8 or 11.16.1).
- Sanitize user-supplied configuration inputs against blocklisted keys such as proto and constructor.
- Implement JSON schema validation on configuration endpoints to restrict accepted properties to an explicit allowlist.
Remediation Steps:
- Identify any code patterns invoking mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig() with dynamic parameters.
- Upgrade mermaid package dependencies in package.json to the fixed versions.
- Apply input-filtering middleware or validate the configuration shape using schema validators.
- Deploy Content Security Policy (CSP) headers to restrict any fallback script execution in the browser environment.
References
- GitHub Security Advisory GHSA-c4c3-pg64-4m4v
- Mermaid Pull Request 8022
- Mermaid Fix Commit (v11.x)
- Mermaid Fix Commit (v10.x)
- Mermaid Release Tag 11.16.1
- Mermaid Release Tag 10.9.8
- CVE.org Authority Record
Read the full report for CVE-2026-71438 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)