From 67aacdebe4f0f62605bf4aaabea11fd92b71030f Mon Sep 17 00:00:00 2001
From: Alois Klink <alois@mermaidchart.com>
Date: Mon, 30 Mar 2026 21:54:25 +0900
Subject: [PATCH] fix: sanitize config for `__` keys

According to upstream, this is supposed to be fore prototype pollution
prevention.

See: https://github.com/mermaid-js/mermaid/blob/9745f325cb9e1967640f0e85da193a2f820634f1/packages/mermaid/src/config.ts#L169-L174
---
 src/lib/util/state.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/lib/util/state.ts b/src/lib/util/state.ts
index 429cf736..79f8355a 100644
--- a/src/lib/util/state.ts
+++ b/src/lib/util/state.ts
@@ -180,6 +180,11 @@ function getUnsafePaths(object: object, unsafeKeys: string[], path: string[] = [
   Object.keys(object).forEach((key) => {
     const value = object[key] as unknown;
     const currentPath = [...path, key];
+    // Prototype pollution check.
+    if (key.startsWith('__')) {
+      unsafePaths.push(currentPath);
+      return;
+    }
     if (typeof value === 'object' && value !== null) {
       unsafePaths.push(...getUnsafePaths(value as object, unsafeKeys, currentPath));
     }