{"uuid": "49c2d14e-ffd4-4c97-af9b-b469c8fb5dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-c4c3-pg64-4m4v", "type": "seen", "source": "https://gist.github.com/alon710/1523a448808a9bd39531599fad70a2e8", "content": "# CVE-2026-71438: CVE-2026-71438: Prototype Pollution in Mermaid Configuration APIs\n\n> **CVSS Score:** 2.4\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71438\n\n## Summary\nPrior to versions 10.9.8 and 11.16.1, Mermaid is vulnerable to prototype pollution via its deep-merge utility function assignWithDepth. This helper is invoked by public configuration-setting interfaces, specifically mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig. Because assignWithDepth recursively merges developer-provided properties into Mermaid's internal configuration state without proper sanitization, an attacker who can control or influence the configuration payload can corrupt the global Object.prototype. This vulnerability can lead to security bypasses, cross-site scripting (XSS), or execution flow modifications in applications using vulnerable Mermaid integrations.\n\n## TL;DR\nA prototype pollution vulnerability in Mermaid's deep-merge utility allowed global prototype corruption when processing untrusted configuration objects, resolved in patched versions via strict Object.hasOwn and Object.defineProperty checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Local / Indirect via host configuration sink\n- **CVSS Score**: 2.4 (Low)\n- **EPSS Score**: 0.00043\n- **Impact**: Security control bypass, global property modification\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mermaid JS Library\n- Applications dynamically initializing Mermaid with user-controlled configuration objects\n- **mermaid**: < 10.9.8 (Fixed in: `10.9.8`)\n- **mermaid**: >= 11.0.0-alpha.1, < 11.16.1 (Fixed in: `11.16.1`)\n\n## Mitigation\n\n- Upgrade Mermaid to patched versions (10.9.8 or 11.16.1).\n- Sanitize user-supplied configuration inputs against blocklisted keys such as __proto__ and constructor.\n- Implement JSON schema validation on configuration endpoints to restrict accepted properties to an explicit allowlist.\n\n**Remediation Steps:**\n1. Identify any code patterns invoking mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig() with dynamic parameters.\n2. Upgrade mermaid package dependencies in package.json to the fixed versions.\n3. Apply input-filtering middleware or validate the configuration shape using schema validators.\n4. Deploy Content Security Policy (CSP) headers to restrict any fallback script execution in the browser environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-c4c3-pg64-4m4v](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v)\n- [Mermaid Pull Request 8022](https://github.com/mermaid-js/mermaid/pull/8022)\n- [Mermaid Fix Commit (v11.x)](https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43)\n- [Mermaid Fix Commit (v10.x)](https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956)\n- [Mermaid Release Tag 11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)\n- [Mermaid Release Tag 10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-71438)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71438) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T20:32:06.872949Z"}