Description
Mermaid’s configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid’s internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.
Recommendation
Update the mermaid package to the latest compatible version. Followings are version details:
Affected version(s): **< 10.9.8 >= 11.0.0-alpha.1, < 11.16.1** Patched version(s): **10.9.8 11.16.1**
References
Could your website be exposed too?
SmartScanner can check your website for Mermaid configuration APIs allow prototype pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Mermaid Architecture diagrams are vulnerable to prototype pollution - CVE-2026-71437
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
You might also like:
See something that needs correcting? Let us knowUpdated August 06, 2026