CVE-2026-71438: Mermaid Package Prototype Pollution Vulnerability
Summary
CVE-2026-71438: Mermaid configuration APIs allow prototype pollution. Affects mermaid across 2 version ranges.
< 10.9.8
>= 11.0.0-alpha.1, < 11.16.1
Fixed in 10.9.8 or 11.16.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an open-source JavaScript library that enables the generation of diagrams and flowcharts from text-based descriptions. It is widely used in documentation and project management tools for its ability to create visual representations of complex information. The library provides configuration APIs that allow developers to customize its behavior and appearance. However, a recent vulnerability has been identified that could potentially allow for prototype pollution through these configuration APIs.
Vulnerability Detail
The vulnerability arises from the way Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) handle incoming configuration objects. These functions utilize a deep-merge helper called assignWithDepth, which is susceptible to prototype pollution. This means that an attacker could manipulate the configuration object to modify the prototype of built-in JavaScript objects, leading to unexpected behavior and potential security risks. Although the risk is assessed as low, it is crucial to avoid passing untrusted data into these APIs.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.9.810.9.8npm install mermaid@10.9.8 -
>= 11.0.0-alpha.1, < 11.16.111.16.1npm install mermaid@11.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Avoid passing user-controlled data directly to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, utilize the %%{init: {}}%% syntax or YAML frontmatter in your diagrams to safely configure Mermaid.
Conclusion
The CVE-2026-71438 vulnerability in the Mermaid package allows for prototype pollution through its configuration APIs. While the risk is low, it is essential to update to the latest patched versions or implement workarounds to mitigate potential security issues. Regular monitoring and updates are crucial for maintaining application security.
See every vulnerability recorded for mermaid →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior in applications.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to test your application without needing to sign up.
While the risk is considered low, if exploited, this vulnerability could allow an attacker to modify critical application behavior, leading to security breaches or data manipulation.
Yes, user-controlled configuration in diagram code using %%{init: {}}%% or YAML frontmatter is already protected from prototype pollution.
If an immediate update is not possible, ensure that you do not pass any user-controlled data to the vulnerable configuration APIs as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
