CVE-2026-71437: Mermaid Package Vulnerable to Prototype Pollution in Architecture Diagrams
Summary
CVE-2026-71437: Mermaid Architecture diagrams are vulnerable to prototype pollution. Affects mermaid versions >= 11.5.0, < 11.16.1. Fixed in 11.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an open-source JavaScript library that enables users to create diagrams and visualizations using a simple markdown-like syntax. It is widely used for generating flowcharts, sequence diagrams, and architecture diagrams. The library allows users to render complex diagrams quickly and easily, making it a popular choice among developers and technical writers. However, a recent vulnerability has been identified that allows for prototype pollution through the architecture-beta diagram feature, posing a risk to applications that utilize this functionality.
Vulnerability Detail
The vulnerability arises from the ability to render untrusted architecture-beta diagrams, which allows an attacker to write arbitrary properties with the values 'horizontal' or 'vertical' onto Object.prototype. This is achieved by using a group ID of 'proto' as a valid parent. The impact of this vulnerability includes the potential for corrupted configuration defaults, bypassed truthiness checks, and possible denial of service or logic corruption in the embedding application. Although the injected values cannot be objects or functions, they can still lead to significant issues in the application's behavior. The vulnerability was introduced in commit cb0a4703bdf01d47508bde1c08aa9a980d70bc20 and first appeared in version 11.5.0 of the Mermaid package.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.16.1
This is the first release that contains the fix.
npm install mermaid@11.16.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
The CVE-2026-71437 vulnerability in the Mermaid package poses a significant risk through prototype pollution in architecture diagrams. It is crucial for users of the package to update to version 11.16.1 to mitigate this risk. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for mermaid →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications that rely on that object.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
The impacts include corrupted configuration defaults, bypassed truthiness checks, and possible denial of service or logic corruption in the embedding application.
No, the injected values cannot be objects or functions, which means this vulnerability is not directly exploitable for remote code execution.
You can use tools like Vulert to receive real-time alerts for vulnerabilities in your open-source dependencies, ensuring that you are always informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
