Mermaid Architecture diagrams are vulnerable to prototype pollution

Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of proto is accepted as a valid parent. Impact Any code in the same realm that reads a property of that name from an arbitra...

CVE-2026-71437

Mermaid.js architecture diagrams are affected by prototype pollution in versions 11.5.0–11.16.1. A diagram-defined group with id proto uses the id as an object property key, allowing pollution of Object.prototype and potentially affecting embedding applications. The issue is fixed in Mermaid v11....

CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...