CVE-2026-71438

{"id": "CVE-2026-71438", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71438", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T15:40:20.347360Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mermaid-js", "product": "mermaid", "versions": [{"status": "affected", "version": "< 10.9.8"}, {"status": "affected", "version": ">= 11.0.0-alpha.1, < 11.16.1"}]}]}], "published": "2026-08-06T22:18:30.873", "references": [{"url": "https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/pull/8022", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8", "source": "security-advisories@github.com"}, {"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-supplied configuration into Mermaid's internal config using the assignWithDepth deep-merge helper, which is vulnerable to prototype pollution. This is only exploitable if an application forwards untrusted data directly into one of these configuration entry points, which is outside their documented usage; diagram-supplied configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not affected. This issue is fixed in versions 10.9.8 and 11.16.1."}, {"lang": "es", "value": "Mermaid es una herramienta de JavaScript que utiliza texto inspirado en Markdown para crear y modificar diagramas y gr\u00e1ficos. Antes de las versiones 10.9.8 y 11.16.1, los setters de configuraci\u00f3n de Mermaid (mermaid.initialize, mermaidAPI.setConfig y mermaidAPI.updateSiteConfig) fusionan la configuraci\u00f3n proporcionada por el llamador en la configuraci\u00f3n interna de Mermaid utilizando la funci\u00f3n auxiliar de fusi\u00f3n profunda assignWithDepth, que es vulnerable a la contaminaci\u00f3n de prototipos. Esto solo es explotable si una aplicaci\u00f3n reenv\u00eda datos no confiables directamente a uno de estos puntos de entrada de configuraci\u00f3n, lo cual est\u00e1 fuera de su uso documentado; la configuraci\u00f3n proporcionada por el diagrama (por ejemplo, %%{init: {}}%% o el frontmatter YAML) no se ve afectada. Este problema est\u00e1 solucionado en las versiones 10.9.8 y 11.16.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}