Vulnerability in mermaid (CVE-2026-71438)
Summary
Vulnerability in mermaid (CVE-2026-71438). Risk of unauthorized operations or information disclosure. Exploitable via mermaid.initialize. Mitigation: upgrade to 10.9.8 or later.
Original description
The description as published by the source.
Summary
Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.
Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.
User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.
Patches
This has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in Mermaid v11.16.1.
A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8
Impact
Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.
Workarounds
Don't pass user-controlle…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-71438 has been found in mermaid.
Attackers can target a specific entry point like mermaid.initialize over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade mermaid to 10.9.8 or later.
If unsure, ask your IT team or search "mermaid CVE-2026-71438" on the vendor's site.
CVE-2026-71438 (mermaid) — CWE-1321
Attack surface: mermaid.initialize / mermaidAPI.setConfig / mermaidAPI.updateSiteConfig / assignWithDepth
Patched: 10.9.8 — apply immediately
Workaround: Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-1321) exists in mermaid. Attackers reach the vulnerable code path via mermaid.initialize.
Check the vendor advisory for the affected versions of mermaid. Attack surface: mermaid.initialize / mermaidAPI.setConfig / mermaidAPI.updateSiteConfig / assignWithDepth.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 10.9.8.
Workaround: Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'mermaid' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'mermaid' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
mermaidを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Don't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions.パッチが適用されるまでの応急処置として、Don't pass user-controlled data to the
mermaid.initialize,mermaidAPI.setConfig, andmermaidAPI.updateSiteConfigfunctions. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade mermaid to 10.9.8ステージング環境で 10.9.8 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。