CVE-2026-71437
NoneCVSS
—
EPSS
0.5%
Published
Aug 6, 2026
CISA due date
—
The record
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of __proto__. Because the group id is used directly as an object property key without validation, an attacker who can supply diagram text can pollute Object.prototype, potentially affecting the behavior of the embedding application. This issue is fixed in version 11.16.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-1321
- CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
- CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
- CVE-2026-104183 stream-json is a micro-library of stream components for processing JSON and JSONC with a… CWE-1321
- CVE-2026-102992 piscina is a node.js worker pool implementation. CWE-1321
- CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
- CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
- CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321