CVE-2026-71438 in Mermaid
Summary
by MITRE • 08/07/2026
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Mermaid affects JavaScript applications that utilize the mermaid library for generating diagrams and charts through Markdown-inspired text syntax. This security flaw exists in versions prior to 10.9.8 and 11.16.1, where the configuration management system becomes susceptible to prototype pollution attacks. The core issue stems from the use of a deep-merge helper function called assignWithDepth within the configuration setters including mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig.
The technical flaw occurs when these configuration functions merge caller-supplied data with Mermaid's internal configuration using the vulnerable assignWithDepth helper. This deep-merge operation allows attackers to manipulate the prototype chain of objects within Mermaid's configuration structure, potentially enabling arbitrary code execution or other malicious behaviors. The vulnerability specifically targets the way configuration objects are merged, creating opportunities for attackers to inject malicious properties into the prototype chain that could be exploited during subsequent operations.
The operational impact of this vulnerability is significant for applications that accept untrusted input through Mermaid's configuration interfaces. When an application directly forwards user-supplied data into any of these configuration entry points without proper sanitization, it creates a vector for prototype pollution attacks. This scenario represents a deviation from documented usage patterns since the normal diagram configuration methods like %%{init: {}}%% directives or YAML frontmatter are not affected by this vulnerability. The exploitation requires specific conditions where untrusted data flows directly into the configuration setters rather than being processed through Mermaid's intended diagram parsing mechanisms.
Security mitigations for this vulnerability involve updating to Mermaid versions 10.9.8 or 11.16.1, which contain patches addressing the prototype pollution issue in the assignWithDepth helper function. Organizations should also implement proper input validation and sanitization practices when processing untrusted data that might reach configuration setters, ensuring that any user-supplied values are properly validated before being passed to Mermaid's initialization functions. Additionally, following security best practices such as implementing least privilege principles and avoiding direct data forwarding from untrusted sources into configuration interfaces will help prevent exploitation of this class of vulnerability.
This vulnerability aligns with common weakness enumerations identified in CWE-471, which describes the use of a function that can be easily manipulated to pollute an object's prototype chain. The attack pattern corresponds to techniques documented in the MITRE ATT&CK framework under T1555.002 for credential access through software supply chain compromises and T1211 for exploitation of vulnerabilities in web applications. The fix implemented in Mermaid versions 10.9.8 and 11.16.1 demonstrates proper defensive programming practices that prevent prototype pollution by ensuring configuration merging operations do not inadvertently modify object prototypes, thereby maintaining the integrity of Mermaid's internal configuration structures.