Prototype Pollution

Mermaid is vulnerable to Prototype Pollution. The vulnerability is due to assignWithDepth being used to deep-merge caller-supplied configuration into Mermaid's internal config, allowing prototype pollution when untrusted data is passed directly to configuration setters such as mermaid.initialize...

Prototype Pollution

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the assignWithDepth process used by configuration APIs. An attacker can modify internal object properties b...

CVE-2026-71438: Improperly Controlled Modification of Object Prototype Attributes

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...