CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1.

Database specific

{
    "cwe_ids": [
        "CWE-1321"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71438.json"
}

References

Affected packages

Git / github.com/mermaid-js/mermaid

Affected ranges

Type

GIT

Repo

https://github.com/mermaid-js/mermaid

Events

Introduced

Fixed

49c1a1c7d1faa995b07cc7224543bd0d9a7a9e70

Fixed

7ecca0cd7f1658ef74f4e7e91f925724ef403bbf

Fixed

2cd6dcf735533b323507e3e889ffdea870540b43

Fixed

c34b07a0815842327e70794d69b0c8c5a1e2a956

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.9.8"
        },
        {
            "introduced": "11.0.0-alpha.1"
        },
        {
            "fixed": "11.16.1"
        }
    ]
}

Affected versions

0.*

0.1.0

0.1.1

0.2.0

0.2.1

0.2.13

0.2.14

0.2.15

0.2.16

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.4.0

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.5.7

6.*

6.0.0

7.*

7.0.0

7.0.2

7.0.3

7.0.5

8.*

8.1.0

8.11.0-rc2

8.11.3

8.11.4

8.12.1

8.13.10

8.13.11

8.13.5

8.13.6

8.13.7

8.2.0

8.2.1

8.2.2

8.2.3

8.2.4

8.2.5

8.2.6

8.3.0

8.4.4

8.4.6

8.4.8

8.5.1

8.5.2

8.6.0

8.6.2

8.7.0

8.8.0

8.8.3

8.9.1

8.9.3

9.*

9.1.2

9.1.3

9.1.5

@mermaid-js/examples@1.*

@mermaid-js/examples@1.1.0

@mermaid-js/examples@1.2.0

@mermaid-js/examples@1.3.0

@mermaid-js/layout-elk@0.*

@mermaid-js/layout-elk@0.1.1

@mermaid-js/layout-elk@0.1.2

@mermaid-js/layout-elk@0.1.3

@mermaid-js/layout-elk@0.1.4

@mermaid-js/layout-elk@0.1.5

@mermaid-js/layout-elk@0.1.6

@mermaid-js/layout-elk@0.1.7

@mermaid-js/layout-elk@0.1.8

@mermaid-js/layout-elk@0.1.9

@mermaid-js/layout-elk@0.2.0

@mermaid-js/layout-elk@0.2.1

@mermaid-js/layout-elk@0.2.2

@mermaid-js/layout-tidy-tree@0.*

@mermaid-js/layout-tidy-tree@0.2.0

@mermaid-js/layout-tidy-tree@0.2.1

@mermaid-js/layout-tidy-tree@0.2.2

@mermaid-js/mermaid-zenuml@0.*

@mermaid-js/mermaid-zenuml@0.2.1

@mermaid-js/mermaid-zenuml@0.2.2

@mermaid-js/mermaid-zenuml@0.2.3

@mermaid-js/parser@0.*

@mermaid-js/parser@0.2.0

@mermaid-js/parser@0.3.0

@mermaid-js/parser@0.4.0

@mermaid-js/parser@0.5.0

@mermaid-js/parser@0.6.0

@mermaid-js/parser@0.6.1

@mermaid-js/parser@0.6.3

@mermaid-js/parser@1.*

@mermaid-js/parser@1.0.0

@mermaid-js/parser@1.0.1

@mermaid-js/parser@1.1.0

@mermaid-js/parser@1.1.1

@mermaid-js/parser@1.2.0

@mermaid-js/tiny@11.*

@mermaid-js/tiny@11.10.0

@mermaid-js/tiny@11.10.1

@mermaid-js/tiny@11.11.0

@mermaid-js/tiny@11.12.0

@mermaid-js/tiny@11.12.1

@mermaid-js/tiny@11.12.3

@mermaid-js/tiny@11.13.0

@mermaid-js/tiny@11.14.0

@mermaid-js/tiny@11.16.0

@mermaid-js/tiny@11.7.0

@mermaid-js/tiny@11.8.0

@mermaid-js/tiny@11.8.1

mermaid@11.*

mermaid@11.0.1

mermaid@11.0.2

mermaid@11.1.0

mermaid@11.1.1

mermaid@11.10.0

mermaid@11.10.1

mermaid@11.11.0

mermaid@11.12.0

mermaid@11.12.1

mermaid@11.12.2

mermaid@11.12.3

mermaid@11.13.0

mermaid@11.14.0

mermaid@11.15.0

mermaid@11.16.0

mermaid@11.2.0

mermaid@11.2.1

mermaid@11.3.0

mermaid@11.4.0

mermaid@11.4.1

mermaid@11.5.0

mermaid@11.6.0

mermaid@11.7.0

mermaid@11.8.0

mermaid@11.8.1

Other

untagged-31c93788afe260d914bb

untagged-566ebfbf21141b604025

untagged-7651dabb407ecd5631ce

untagged-f43366252632a1a42020

v10.*

v10.1.0

v10.3.0

v10.4.0

v10.7.0

v10.9.0

v10.9.1

v10.9.2

v10.9.3

v10.9.4

v10.9.5

v10.9.6

v10.9.7

v11.*

v11.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71438.json"