High severityNVD Advisory· Published Mar 12, 2026· Updated Mar 14, 2026
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
CVE-2026-32308
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
oneuptimenpm | < 10.0.23 | 10.0.23 |
Affected products
2- OneUptime/oneuptimev5Range: < 10.0.23
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wvh5-6vjm-23qhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32308ghsaADVISORY
- github.com/OneUptime/oneuptime/releases/tag/10.0.23ghsaWEB
- github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qhghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.