Mermaid-js mermaid versions before 10.9.8 and 11.16.1 have a prototype pollution vulnerability (CWE-1321) in their configuration setters (mermaid.initialize, mermaidAPI.setConfig, mermaidAPI.updateSiteConfig). These setters use the assignWithDepth deep-merge helper to merge caller-supplied configuration into the internal config, which is vulnerable to prototype pollution. Exploitation requires an application to forward untrusted data directly into these configuration entry points, which is not the intended or documented usage. Diagram-supplied configuration methods such as %%{init: {}}%% or YAML frontmatter are not vulnerable. The vulnerability is addressed in versions 10.9.8 and 11.16.1.

If an application improperly forwards untrusted input directly into the vulnerable configuration setters, an attacker could manipulate the prototype of internal objects, potentially leading to unexpected behavior or security issues. However, this requires a specific misuse pattern outside the documented usage, limiting the practical impact. The vulnerability does not affect diagram-supplied configuration inputs. The CVSS 4.0 base score is 2.4, indicating low severity.

Upgrade mermaid-js mermaid to version 10.9.8 or later, or 11.16.1 or later, where the prototype pollution vulnerability is fixed. Avoid passing untrusted data directly into the configuration setters (mermaid.initialize, mermaidAPI.setConfig, mermaidAPI.updateSiteConfig). Diagram-supplied configuration methods are not vulnerable and require no changes.