CVE-2026-71438: Mermaid Mermaid Configuration APIs Allow Prototype Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c4c3-pg64-4m4v",
  "modified" : "2026-08-06T19:59:10Z",
  "published" : "2026-08-06T19:59:10Z",
  "aliases" : [ "CVE-2026-71438" ],
  "summary" : "Mermaid configuration APIs allow prototype pollution",
  "details" : "### Summary\n\nMermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-supplied configuration object into Mermaid's internal config using the `assignWithDepth` deep-merge helper that is vulnerable to prototype pollution.\n\nBecause these APIs are intended to receive **trusted** configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as **low**. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.\n\nUser-controlled configuration (e.g. configuration in diagram code using `%%{init: {}}%%` or YAML frontmatter) are already protected from prototype pollution.\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Impact\n\nMermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.\n\n### Workarounds\n\nDon't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions. Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams.\n\n### Reporters\n\n- liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/\n- ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/\n- cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/\n- chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/\n- cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "mermaid"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0-alpha.1"
      }, {
        "fixed" : "11.16.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "mermaid"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "10.9.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/pull/8022"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/mermaid-js/mermaid"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1321" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-06T19:59:10Z",
    "nvd_published_at" : null
  }
}