CVE-2026-71438
1 advisory.
npm/mermaid CVE-2026-71438: low
Mermaid configuration APIs allow prototype pollution
Action: Upgrade mermaid to 10.9.8 or later.
npm i mermaid@11.16.1npm i mermaid@10.9.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0-alpha.1 | 11.16.1 | - |
| 0 | 10.9.8 | - |
Fixed versions
| 11.16.1 | 10.9.8 |
Sources
- osv: GHSA-c4c3-pg64-4m4v
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
- https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
CVE-2026-71438 · published · modified · JSON