CVE-2026-71438

{
  "id": "CVE-2026-71438",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:30.873",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1."
    },
    {
      "lang": "es",
      "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gráficos. Antes de las versiones 10.9.8 y 11.16.1, los setters de configuración de Mermaid (mermaid.initialize, mermaidAPI.setConfig y mermaidAPI.updateSiteConfig) fusionan la configuración proporcionada por el llamador en la configuración interna de Mermaid utilizando la función auxiliar de fusión profunda assignWithDepth, que es vulnerable a la contaminación de prototipos. Esto solo es explotable si una aplicación reenvía datos no confiables directamente a uno de estos puntos de entrada de configuración, lo cual está fuera de su uso documentado; la configuración proporcionada por el diagrama (por ejemplo, %%{init: {}}%% o el frontmatter YAML) no se ve afectada. Este problema está solucionado en las versiones 10.9.8 y 11.16.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mermaid-js",
          "product": "mermaid",
          "versions": [
            {
              "version": "< 10.9.8",
              "status": "affected"
            },
            {
              "version": ">= 11.0.0-alpha.1, < 11.16.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.4,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:40:20.347360Z",
          "id": "CVE-2026-71438",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/pull/8022",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v",
      "source": "[email protected]"
    }
  ]
}