CVE-2026-32308

HIGH

7.6

Descripcion

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

Detalles CVE

Puntuacion CVSS v3.17.6

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/13/2026

Ultima modificacion3/17/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

hackerbay:oneuptime

Debilidades (CWE)

CWE-79

Referencias

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.