CVE-2026-71437: Mermaid prototype pollution in architecture-beta diagrams

CVE-2026-71437 · Severity: medium · CVSS 4 · Published 2026-08-06

Mermaid is a JavaScript library used to generate diagrams from markdown-like syntax. An attacker can craft a malicious architecture-beta diagram that pollutes the JavaScript Object.prototype, allowing injection of arbitrary properties into all objects. While the injected values are limited to strings, this can corrupt configuration defaults, bypass security checks, or cause application logic errors in any code using the rendering application, leading to denial of service or data integrity issues.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-71437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71437 being exploited in the wild.
How severe is CVE-2026-71437?
Medium severity, with a CVSS score of 4, published 6 August 2026.
Which products and versions are affected?
mermaid (npm) >= 11.5.0, < 11.16.1, SEMVER:introduced=11.5.0,fixed=11.16.1.
Is there a fix for CVE-2026-71437?
Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71437 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71437?
Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mermaid (npm): upgrade to 11.16.1 or later
    npm install mermaid@11.16.1

Technical details

A prototype pollution vulnerability exists in Mermaid's architecture-beta diagram renderer. The vulnerability arises from unsafe handling of group IDs: an attacker can specify __proto__ as a parent group ID, which causes the renderer to write an arbitrary property (with value constrained to "horizontal" or "vertical") directly onto Object.prototype. This occurs because the code uses plain JavaScript object notation (Record&lt;string, ...&gt;) rather than Map for storing group alignments, making it vulnerable to prototype chain pollution. The attack requires the ability to provide untrusted diagram input and for the embedding application to use the rendered diagram. While the injected property values are restricted to strings, any code in the same JavaScript realm that reads these properties or iterates objects will observe the polluted values, leading to corrupted defaults, bypassed checks, or logic corruption. The fix (released in v11.16.1) refactors the code to use Map instead of plain objects, preventing prototype pollution. Affected versions: 11.5.0 through 11.16.0.

Affected products

  • mermaid-js mermaid >=11.5.0, <11.16.1

Identifiers

  • CVE-2026-71437
  • GHSA-3rrr-jr9j-h3q3

Timeline

  • 2026-08-06: disclosed
  • 2026-08-06: patched: Patched in mermaid v11.16.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.