{"vulnerability": "cve-2026-7143", "sightings": [{"uuid": "9cab48c5-e009-4ed0-8ee0-691ab345b923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71438", "type": "seen", "source": "https://gist.github.com/alon710/1523a448808a9bd39531599fad70a2e8", "content": "# CVE-2026-71438: CVE-2026-71438: Prototype Pollution in Mermaid Configuration APIs\n\n> **CVSS Score:** 2.4\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71438\n\n## Summary\nPrior to versions 10.9.8 and 11.16.1, Mermaid is vulnerable to prototype pollution via its deep-merge utility function assignWithDepth. This helper is invoked by public configuration-setting interfaces, specifically mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig. Because assignWithDepth recursively merges developer-provided properties into Mermaid's internal configuration state without proper sanitization, an attacker who can control or influence the configuration payload can corrupt the global Object.prototype. This vulnerability can lead to security bypasses, cross-site scripting (XSS), or execution flow modifications in applications using vulnerable Mermaid integrations.\n\n## TL;DR\nA prototype pollution vulnerability in Mermaid's deep-merge utility allowed global prototype corruption when processing untrusted configuration objects, resolved in patched versions via strict Object.hasOwn and Object.defineProperty checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Local / Indirect via host configuration sink\n- **CVSS Score**: 2.4 (Low)\n- **EPSS Score**: 0.00043\n- **Impact**: Security control bypass, global property modification\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mermaid JS Library\n- Applications dynamically initializing Mermaid with user-controlled configuration objects\n- **mermaid**: < 10.9.8 (Fixed in: `10.9.8`)\n- **mermaid**: >= 11.0.0-alpha.1, < 11.16.1 (Fixed in: `11.16.1`)\n\n## Mitigation\n\n- Upgrade Mermaid to patched versions (10.9.8 or 11.16.1).\n- Sanitize user-supplied configuration inputs against blocklisted keys such as __proto__ and constructor.\n- Implement JSON schema validation on configuration endpoints to restrict accepted properties to an explicit allowlist.\n\n**Remediation Steps:**\n1. Identify any code patterns invoking mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig() with dynamic parameters.\n2. Upgrade mermaid package dependencies in package.json to the fixed versions.\n3. Apply input-filtering middleware or validate the configuration shape using schema validators.\n4. Deploy Content Security Policy (CSP) headers to restrict any fallback script execution in the browser environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-c4c3-pg64-4m4v](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v)\n- [Mermaid Pull Request 8022](https://github.com/mermaid-js/mermaid/pull/8022)\n- [Mermaid Fix Commit (v11.x)](https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43)\n- [Mermaid Fix Commit (v10.x)](https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956)\n- [Mermaid Release Tag 11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)\n- [Mermaid Release Tag 10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-71438)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71438) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T20:32:06.898752Z"}, {"uuid": "b6a35591-6b84-49f5-b6a3-c0af946754be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71436", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-2v8p-3f2j-5mp7", "content": "", "creation_timestamp": "2026-08-06T20:35:03.266320Z"}, {"uuid": "2effcce5-d591-4270-9be8-f6e11fb19b15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71430", "type": "published-proof-of-concept", "source": "https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp", "content": "", "creation_timestamp": "2026-08-06T22:35:12.262023Z"}, {"uuid": "4deab25d-6d80-44bd-9f98-072a59093e14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71439", "type": "published-proof-of-concept", "source": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh", "content": "", "creation_timestamp": "2026-08-06T22:35:14.538678Z"}, {"uuid": "23bfd035-e8ef-44dc-815e-940c520d94a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71430", "type": "seen", "source": "https://gist.github.com/alon710/455dd27ab1381c77c49e252fb102cb9f", "content": "# CVE-2026-71430: CVE-2026-71430: Denial of Service via Native Assertion Failure in node-re2 Replace Operation\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71430\n\n## Summary\nA denial-of-service vulnerability in node-re2 prior to version 1.25.1 allows attackers to trigger uncatchable native assertion failures in the Google V8 engine. By supplying output-amplifying replacement templates, an attacker can exceed V8 string limits, resulting in an immediate process crash.\n\n## TL;DR\nVulnerable versions of node-re2 invoke .ToLocalChecked() on empty V8 handles when string allocations fail due to length limits, crashing the entire Node.js runtime process with SIGABRT.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-617: Reachable Assertion\n- **Attack Vector**: Local (escalatible to Network/Remote under specific application configurations)\n- **CVSS Score**: 6.2 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **Impact**: Denial of Service (DoS) via native process abort\n\n## Affected Systems\n\n- Applications utilizing the 're2' npm package (< 1.25.1) on Node.js runtimes.\n- **re2**: < 1.25.1 (Fixed in: `1.25.1`)\n\n## Mitigation\n\n- Upgrade node-re2 dependency to version 1.25.1 or higher.\n- Restrict max length of user-controlled input strings handled by regex operations.\n- Sanitize or disallow dangerous replace templates containing '$'' or '$`'.\n\n**Remediation Steps:**\n1. Open your project's package.json file.\n2. Locate the 're2' or 'node-re2' dependency and update its version to '^1.25.1'.\n3. Run your package manager install command (e.g., 'npm install' or 'yarn install') to apply the updates.\n4. Execute your regression test suites to verify system integration with the patched binary library.\n\n## References\n\n- [GitHub Security Advisory GHSA-8hcv-x26h-mcgp](https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp)\n- [Fix Commit](https://github.com/uhop/node-re2/commit/5f4e7f9a752e8ef0d1ba7e71f21f7059d0ed0e95)\n- [CVE-2026-71430 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T06:34:35.820929Z"}]}