EUVD-2026-54244
GHSA-c4c3-pg64-4m4v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N and PR:N reflect attacker reaching a web-facing application; AC:H because exploitation requires the host app to non-standardly forward user input to config functions; S:C for prototype pollution affecting the shared JavaScript Object prototype.
Primary rating from Vendor (https://github.com/mermaid-js/mermaid).
CVSS VectorVendor: https://github.com/mermaid-js/mermaid
Lifecycle Timeline
3DescriptionCVE.org
Summary
Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.
Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.
User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.
Patches
This has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in Mermaid v11.16.1.
A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8
Impact
Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.
Workarounds
Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, users can use %%{init: {}}%% or YAML frontmatter in diagrams.
Reporters
- liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
- ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/
- cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/
- chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/
- cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/
AnalysisAI
Prototype pollution in the Mermaid JavaScript diagramming library (npm/mermaid) exposes applications to JavaScript Object prototype manipulation when attacker-controlled data is incorrectly passed to configuration APIs. The assignWithDepth deep-merge helper used by mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig fails to sanitize __proto__ keys, allowing an attacker to corrupt the shared Object prototype if a host application forwards user-supplied input into these configuration entry points - a usage pattern explicitly outside Mermaid's documented API contract. No public exploit has been identified and no CISA KEV listing exists; vendor risk assessment is low due to the non-standard application integration pattern required for exploitation.
Technical ContextAI
Mermaid is a widely-used JavaScript/TypeScript library (npm package) for rendering diagrams from text-based syntax, commonly embedded in wikis, documentation platforms, and developer tools. The vulnerability (CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes) resides in the assignWithDepth utility function, which performs recursive deep-merge of configuration objects. When a caller passes an object containing a __proto__ key or similar prototype-polluting payload, the merge operation propagates the value into Object.prototype, affecting all JavaScript objects in the same runtime. Affected packages are pkg:npm/mermaid versions >= 11.0.0-alpha.1 up to (excluding) 11.16.1, and all v10 releases prior to 10.9.8. Notably, the user-facing diagram configuration paths (%%{init: {}}%% and YAML frontmatter) were already hardened against this class of attack prior to this disclosure; only the three developer-facing API surfaces remained unprotected.
RemediationAI
Upgrade to Mermaid v11.16.1 (for v11 branch users) or v10.9.8 (for v10 branch users); both releases include the assignWithDepth prototype pollution hardening from commit 2cd6dcf735533b323507e3e889ffdea870540b43 (v11) and backport commit c34b07a0815842327e70794d69b0c8c5a1e2a956 (v10). If patching is not immediately possible, the primary workaround is to ensure that no user-controlled data is ever forwarded to mermaid.initialize, mermaidAPI.setConfig, or mermaidAPI.updateSiteConfig; use the already-protected %%{init: {}}%% directive or YAML frontmatter in diagram code for user-supplied configuration instead - these paths were already sanitized prior to this advisory. Note that mermaidAPI.setConfig() has been marked deprecated in v11.16.1, so callers should begin migration away from it regardless of the security concern. Patch and release details are available at https://github.com/mermaid-js/mermaid/pull/8022 and the release tags above.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today