Junglewise Threat Intelligence

CVE-2026-71437: Mermaid prototype pollution in architecture-beta diagrams

CVE-2026-71437 · Severity: medium · CVSS 4 · Published 2026-08-06

Executive brief

Mermaid is a JavaScript library used to generate diagrams from markdown-like syntax. An attacker can craft a malicious architecture-beta diagram that pollutes the JavaScript Object.prototype, allowing injection of arbitrary properties into all objects. While the injected values are limited to strings, this can corrupt configuration defaults, bypass security checks, or cause application logic errors in any code using the rendering application, leading to denial of service or data integrity issues.

Technical details

A prototype pollution vulnerability exists in Mermaid's architecture-beta diagram renderer. The vulnerability arises from unsafe handling of group IDs: an attacker can specify __proto__ as a parent group ID, which causes the renderer to write an arbitrary property (with value constrained to "horizontal" or "vertical") directly onto Object.prototype. This occurs because the code uses plain JavaScript object notation (Record<string, ...>) rather than Map for storing group alignments, making it vulnerable to prototype chain pollution. The attack requires the ability to provide untrusted diagram input and for the embedding application to use the rendered diagram. While the injected property values are restricted to strings, any code in the same JavaScript realm that reads these properties or iterates objects will observe the polluted values, leading to corrupted defaults, bypassed checks, or logic corruption. The fix (released in v11.16.1) refactors the code to use Map instead of plain objects, preventing prototype pollution. Affected versions: 11.5.0 through 11.16.0.

Affected products

  • mermaid-js mermaid >=11.5.0, <11.16.1

Timeline

  • 2026-08-06: disclosed
  • 2026-08-06: patched: Patched in mermaid v11.16.1

References

Related threats