CVE-2026-71438 is a prototype pollution vulnerability (CWE-1321) in mermaid-js's mermaid tool affecting configuration setters (mermaid.initialize, mermaidAPI.setConfig, mermaidAPI.updateSiteConfig). These functions merge user-supplied configuration into internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This flaw can be exploited only if untrusted data is forwarded directly into these configuration setters, which is not the intended usage. Diagram-supplied configuration methods such as %%{init: {}}%% or YAML frontmatter are not vulnerable. The issue is resolved in versions 10.9.8 and 11.16.1.

The vulnerability allows improper modification of object prototype attributes via configuration setters, potentially leading to unexpected behavior or security issues in applications that improperly forward untrusted data into these setters. However, the risk is low because exploitation requires a non-standard usage pattern (directly forwarding untrusted data), and typical diagram-supplied configurations are not affected.

Upgrade mermaid to version 10.9.8 or later, or 11.16.1 or later, where this prototype pollution vulnerability is fixed. Avoid forwarding untrusted data directly into the vulnerable configuration setters. Since the issue is fixed in these versions, applying the official update is the recommended remediation.