CVE-2026-71438: 
JavaScript 脆弱性の分析と軽減

CVE-2026-71438 is a prototype pollution vulnerability in Mermaid, a JavaScript diagramming library, affecting its configuration setter APIs (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig). These functions use the assignWithDepth deep-merge helper to incorporate caller-supplied configuration into Mermaid's internal config, and this helper was susceptible to prototype pollution (CWE-1321). The vulnerability affects Mermaid versions prior to 10.9.8 and versions 11.0.0-alpha.1 through 11.16.0. It was disclosed on August 6, 2026, with patches released as versions 10.9.8 and 11.16.1. The CVSS v4 base score is 2.4 (Low), reflecting the narrow exploitation conditions required (GitHub Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution) in the assignWithDepth function within packages/mermaid/src/assignWithDepth.ts. The function recursively merges objects using Object.keys(src) without checking for prototype-polluting keys such as __proto__, constructor, or prototype, allowing an attacker-controlled object to modify Object.prototype properties shared across the JavaScript runtime. Exploitation requires that an application directly forwards untrusted, attacker-controlled data into one of the three configuration entry points — a usage pattern explicitly outside Mermaid's documented API. Notably, diagram-level configuration via %%{init: {}}%% or YAML frontmatter is separately protected and not affected. The fix refactored assignWithDepth to use Object.hasOwn() and Object.defineProperty() instead of direct key assignment, making it prototype-pollution resistant (GitHub Advisory, Fix Commit).

If exploited, prototype pollution can corrupt the JavaScript Object.prototype, potentially affecting all objects in the runtime environment. This could lead to unexpected behavior, security control bypasses, denial of service, or in some contexts, remote code execution depending on how the polluted properties are consumed downstream. The CVSS v4 scoring reflects low impact on the vulnerable system itself (low integrity and availability impact), but high subsequent system impact on confidentiality, integrity, and availability — acknowledging that prototype pollution effects can propagate broadly through a Node.js or browser application. The maintainers assess real-world impact as unlikely, since the vulnerable APIs are intended for trusted, developer-controlled configuration only (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-71438. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (the attacker must control data passed to Mermaid's configuration APIs by the integrating application), active user interaction, and specific deployment conditions where untrusted input is forwarded to these APIs — all of which significantly limit practical exploitability (GitHub Advisory, Feedly).

1. Identify a vulnerable application: Find a web application or Node.js service that integrates Mermaid (versions < 10.9.8 or 11.0.0-alpha.1 to 11.16.0) and, critically, passes user-controlled input directly into mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig().
2. Craft a prototype-polluting payload: Construct a malicious configuration object containing a prototype-polluting key, for example: { "__proto__": { "polluted": true } } or { "constructor": { "prototype": { "polluted": true } } }.
3. Deliver the payload: Submit the crafted object through whatever application input mechanism forwards data to the vulnerable Mermaid configuration API (e.g., a form field, API parameter, or configuration file that the application reads and passes to Mermaid).
4. Trigger prototype pollution: The assignWithDepth function recursively merges the attacker-supplied object into Mermaid's internal config without sanitizing prototype-polluting keys, modifying Object.prototype in the JavaScript runtime.
5. Exploit the polluted prototype: Depending on the application's code, the polluted property may be read by other objects, potentially bypassing security checks, causing unexpected behavior, or enabling further exploitation (GitHub Advisory).

• Logs: Application logs showing unexpected or malformed JSON objects being passed to Mermaid configuration functions; errors related to Object.prototype modification or unexpected property access in JavaScript runtime logs.
• Application Behavior: Unexpected behavior in JavaScript objects across the application (e.g., all objects unexpectedly having a new property); security controls that rely on object property checks behaving anomalously.
• Code Review: Application code that passes user-supplied input (e.g., HTTP request parameters, user-submitted JSON) directly to mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig() without sanitization.
• Network: Requests containing JSON payloads with keys such as __proto__, constructor, or prototype targeting endpoints that process Mermaid configuration.

Upgrade Mermaid to version 10.9.8 (v10 branch) or 11.16.1 (v11 branch), which refactor assignWithDepth to be prototype-pollution resistant using Object.hasOwn() and Object.defineProperty() (Mermaid Release, Fix Commit). As a workaround, avoid passing any user-controlled or untrusted data to mermaid.initialize(), mermaidAPI.setConfig(), or mermaidAPI.updateSiteConfig() — these APIs are designed for trusted, developer-supplied configuration only. For user-supplied diagram configuration, use the supported %%{init: {}}%% syntax or YAML frontmatter within diagram code, which already has prototype pollution protections (GitHub Advisory).

The vulnerability was reported by a group of researchers from the University of Sydney (Liyi Zhou, Ziyue, Strick, Maurice, and Chenchen) and was addressed promptly by Mermaid maintainer aloisklink, who also deprecated the mermaidAPI.setConfig() function as part of the fix, noting it had no observable effect in practice. The maintainers publicly assessed the practical risk as low, stating it is unlikely that any real-world applications are impacted given the non-standard usage pattern required for exploitation (GitHub Advisory, Mermaid Release).