High severity7.6NVD Advisory· Published Mar 13, 2026· Updated Jun 17, 2026
CVE-2026-32308
CVE-2026-32308
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
oneuptimenpm | < 10.0.23 | 10.0.23 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qhnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-wvh5-6vjm-23qhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32308ghsaADVISORY
- github.com/OneUptime/oneuptime/releases/tag/10.0.23ghsaWEB
News mentions
0No linked articles in our index yet.