{"id":"GHSA-c4c3-pg64-4m4v","revision":"a6cce10a096d449b979fc06852ef6499","records":[{"revision":"a6cce10a096d449b979fc06852ef6499","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-c4c3-pg64-4m4v","aliases":["CVE-2026-71438"],"title":"Mermaid configuration APIs allow prototype pollution","description":"### Summary\n\nMermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-supplied configuration object into Mermaid's internal config using the `assignWithDepth` deep-merge helper that is vulnerable to prototype pollution.\n\nBecause these APIs are intended to receive **trusted** configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as **low**. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.\n\nUser-controlled configuration (e.g. configuration in diagram code using `%%{init: {}}%%` or YAML frontmatter) are already protected from prototype pollution.\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Impact\n\nMermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.\n\n### Workarounds\n\nDon't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions. Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams.\n\n### Reporters\n\n- liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/\n- ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/\n- cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/\n- chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/\n- cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/","state":0,"publishedAt":"2026-08-06T19:59:10+00:00","modifiedAt":"2026-09-10T03:51:13.7808567+00:00","affected":[{"ecosystem":"npm","name":"mermaid","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.0.0-alpha.1"},{"kind":"fixed","version":"11.16.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mermaid","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.9.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v","https://github.com/mermaid-js/mermaid/pull/8022","https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43","https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956","https://github.com/mermaid-js/mermaid","https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1","https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"],"sourceUrl":"https://github.com/advisories/GHSA-c4c3-pg64-4m4v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c4c3-pg64-4m4v","identifiers":["GHSA-c4c3-pg64-4m4v","CVE-2026-71438"]},"retained":false,"historicalAffected":[]}],"coverage":[]}