Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M

CVE-2026-32308OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

High 7.6

In plain English

A high-severity cross-site scripting in oneuptime from OneUptime. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	oneuptime	10.0.23	GHSA-wvh5-6vjm-23qh

Affected products (as reported)

Vendor	Product	Versions
OneUptime	oneuptime	< 10.0.23

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh x_refsource_CONFIRM