Prototype pollution in mermaid - CVE-2026-71437
Published: August 4, 2026 / Updated: August 7, 2026
Vulnerability identifier: #VU140932
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71437
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service or corrupt application logic.
The vulnerability exists due to improperly controlled modification of object prototype attributes ('prototype pollution') in the architecture-beta diagram renderer when rendering an untrusted diagram. A remote user can supply a crafted diagram with a group id of __proto__ to cause a denial of service or corrupt application logic.
The injected property value is limited to the string horizontal or vertical and does not directly enable remote code execution.
Affected software
mermaid
Fedora
nextcloud
Fedora
nextcloud
How to mitigate CVE-2026-71437
Install security update from vendor's website.
mermaid - update to 11.16.1
nextcloud - addressed in versions 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44
nextcloud - addressed in versions 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44