CyberRota Analysis
AI-GeneratedMermaid's configuration setters in versions prior to 10.9.8 and 11.16.1 are vulnerable to prototype pollution, which could allow an attacker to manipulate the internal configuration if untrusted data is directly forwarded to these entry points. While the risk is considered low, applications utilizing Mermaid that improperly handle user-supplied configuration should prioritize upgrading to the patched versions to mitigate potential exploitation. Developers and security teams working with JavaScript tools that integrate Mermaid should assess their implementation for this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1.