CVE-2026-71438
Published:August 06, 2026
Updated:August 19, 2026
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1.
Affected Packages
mermaid (CDN_JS):
Affected version(s) >=0.1.0 <10.9.8Fix Suggestion:
Update to version 10.9.8mermaid (CDN_JS):
Affected version(s) >=0.1.0 <10.9.8Fix Suggestion:
Update to version 10.9.8mermaid (CDN_JS):
Affected version(s) >=11.0.0-alpha.1 <11.16.1Fix Suggestion:
Update to version 11.16.1https://github.com/mermaid-js/mermaid.git (GITHUB):
Affected version(s) >=v8.8.4 <v10.9.8Fix Suggestion:
Update to version v10.9.8https://github.com/mermaid-js/mermaid.git (GITHUB):
Affected version(s) >=mermaid@11.0.1 <mermaid@11.16.1Fix Suggestion:
Update to version mermaid@11.16.1mermaid (NPM):
Affected version(s) >=11.0.0-alpha.1 <11.16.1Fix Suggestion:
Update to version 11.16.1mermaid (NPM):
Affected version(s) >=0.2.11 <10.9.8Fix Suggestion:
Update to version 10.9.8mermaid (NPM):
Affected version(s) >=0.2.11 <10.9.8Fix Suggestion:
Update to version 10.9.8Related Resources (9)
Do you need more information?
Contact UsCVSS v4
Base Score:
2.4
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
HIGH
User Interaction
ACTIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
4.2
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS
Base Score:
0.17