CVE-2026-71438

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 10.9.8 Mermaid versions prior to 11.16.1

Description Configuration setters mermaid.initialize(), mermaidAPI.setConfig(), and mermaidAPI.updateSiteConfig() merge caller-supplied configuration into the internal config using the assignWithDepth deep-merge helper, which is susceptible to prototype pollution. Prototype pollution occurs when an attacker can manipulate the prototype of a base object, potentially leading to unexpected behavior or security bypasses. This issue is only exploitable if an application forwards untrusted data directly into these configuration entry points, which deviates from their documented usage.

Recommendations Update to version 10.9.8 or later. Update to version 11.16.1 or later. Avoid passing user-controlled data to the mermaid.initialize(), mermaidAPI.setConfig(), and mermaidAPI.updateSiteConfig() functions.