{"id":"CVE-2026-71438","aliases":["GHSA-c4c3-pg64-4m4v"],"url":"https://o3.security/vulnerability/CVE-2026-71438","summary":"Mermaid configuration APIs allow prototype pollution","details":"### Summary\n\nMermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-supplied configuration object into Mermaid's internal config using the `assignWithDepth` deep-merge helper that is vulnerable to prototype pollution.\n\nBecause these APIs are intended to receive **trusted** configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as **low**. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.\n\nUser-controlled configuration (e.g. configuration in diagram code using `%%{init: {}}%%` or YAML frontmatter) are already protected from prototype pollution.\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Impact\n\nMermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.\n\n### Workarounds\n\nDon't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions. Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams.\n\n### Reporters\n\n- liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/\n- ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/\n- cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/\n- chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/\n- cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/","published":"2026-08-06T19:59:07.450Z","modified":"2026-10-28T02:30:48.267966527Z","cvss":null,"epss":{"score":0.002,"percentile":0.09801,"asOf":"2026-09-03"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mermaid","fixedVersion":"11.16.1"},{"ecosystem":"npm","name":"mermaid","fixedVersion":"10.9.8"}],"fix":{"url":"https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43","label":"mermaid-js/mermaid@2cd6dcf"},"references":[{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1"},{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71438.json"},{"type":"ADVISORY","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71438"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/pull/8022"},{"type":"PACKAGE","url":"https://github.com/mermaid-js/mermaid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:48.267966527Z"}}