CVE-2026-71438 mermaid-js CVE debrief

Who should care

Defenders and developers using Mermaid in applications with untrusted input should assess exposure and prioritize updates to versions 10.9.8 or 11.16.1. They should review application usage of Mermaid's configuration setters and ensure untrusted data is not directly forwarded into configuration entry points. Additionally, they should verify Mermaid version and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-71438 is a low-severity vulnerability in Mermaid that can lead to prototype pollution. Defenders should verify Mermaid versions, review configuration usage, and update to versions 10.9.8 or 11.16.1 if necessary.

• Verification of Mermaid version and configuration usage is necessary
• Potential for prototype pollution if untrusted data is used with configuration setters
• Remediation priority for applications using affected Mermaid versions
• Limited evidence on exploitation, requiring further verification

Technical summary

Mermaid's configuration setters are vulnerable to prototype pollution due to the assignWithDepth deep-merge helper. This issue is exploitable if applications forward untrusted data directly into these configuration entry points. The vulnerability can lead to prototype pollution, which can have security implications if not properly mitigated. The issue is fixed in versions 10.9.8 and 11.16.1, and defenders should prioritize verifying and updating Mermaid to these versions, especially if applications use configuration setters with untrusted data.

Defensive priority

Defenders should prioritize verifying and updating Mermaid to versions 10.9.8 or 11.16.1, especially if applications use configuration setters with untrusted data.

Recommended defensive actions

• Verify Mermaid version and update to 10.9.8 or 11.16.1 if necessary
• Review application usage of Mermaid's configuration setters
• Ensure untrusted data is not directly forwarded into configuration entry points
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the assignWithDepth deep-merge helper used in Mermaid's configuration setters. Evidence is based on official CVE and source records. The issue is exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.