Mermaid configuration APIs allow prototype pollution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-71438 · Microsoft / collected KEV context

EUVD-2026-54244

GHSA-c4c3-pg64-4m4v

cve-program · CVE-2026-71438

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

euvd · EUVD-2026-54244

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

nvd · CVE-2026-71438

• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v

osv · GHSA-c4c3-pg64-4m4v

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

No related operational record is retained in the current change model.