Mermaid CVE-2026-71438

Exploitation requires that the host application passes attacker-controlled data directly into one of three Mermaid configuration functions: mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig(). This usage pattern is explicitly outside Mermaid's documented API contract, which treats these functions as receiving only trusted, developer-supplied values. User-controlled configuration paths (%%{init: {}}%% or YAML frontmatter in diagram code) are already protected and are not exploitable via this vulnerability. Exploitation is therefore limited to scenarios where a developer has written integration code that directly pipes user input into the configuration layer - a non-default, non-standard deployment pattern. Authentication requirements are not confirmed from available data, as no CVSS vector is provided; however, exploitability depends entirely on the host application's architecture and whether it exposes these config functions to external input.

No CVSS vector or EPSS score is available for this CVE, limiting quantitative risk scoring. The vendor explicitly rates practical risk as low: exploitation requires the host application to forward attacker-controlled data directly into a Mermaid configuration API, which is outside documented usage and contrary to the security model of these functions. Tags indicate potential Information Disclosure, consistent with prototype pollution enabling property injection that could leak or overwrite application state. There is no KEV listing and no reported public exploit code, and the advisory states Mermaid believes it unlikely anyone is impacted. The attack chain depends on a misconfigured or intentionally permissive host application, making this a conditional, deployment-dependent vulnerability. From an SSVC perspective, exploitation status is none at time of analysis; automation would depend on the specific host application architecture; and technical impact would be partial, limited to prototype property injection within the JavaScript runtime. The risk is primarily relevant to organizations running custom integrations that pipe user input into Mermaid's configuration layer, which represents a niche and non-standard deployment pattern.

An attacker targets a web application that renders user-submitted Mermaid diagram configurations by passing them directly to mermaid.initialize() or mermaidAPI.setConfig(). The attacker submits a configuration payload containing a __proto__ key with a crafted value, which the assignWithDepth helper merges into Object.prototype, injecting a property visible to all objects in the JavaScript runtime. Depending on how the host application subsequently uses object property lookups, this could enable property overwriting, security control bypass, or information disclosure. No public proof-of-concept has been identified at time of analysis.