7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32308

CVE-2026-32308: OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32308

CVE-2026-32308:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oneuptime	npm	< 10.0.23	10.0.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Markdown rendering feature of OneUptime, specifically affecting Mermaid diagrams. The root cause is twofold. First, the Mermaid library was initialized with securityLevel: "loose", a setting that permits interactive JavaScript within the generated SVG diagrams. Second, the React component MermaidDiagram in Common/UI/Components/Markdown.tsx/MarkdownViewer.tsx took the SVG output from the Mermaid library and inserted it directly into the DOM via innerHTML without any sanitization. This combination allowed an attacker to embed malicious JavaScript in a Mermaid diagram (e.g., using the click directive). When a user viewed a page containing this malicious markdown (such as an incident note or status page), the script would execute, leading to potential session hijacking or other client-side attacks. The patch addresses this by changing the securityLevel to the safer default of "strict" and by introducing DOMPurify to sanitize the SVG before it is rendered, effectively neutralizing the XSS vector.

Vulnerable functions

MermaidDiagram

Common/UI/Components/Markdown.tsx/MarkdownViewer.tsx

The `MermaidDiagram` component is a React functional component responsible for rendering Mermaid diagrams. In its vulnerable state, it used `mermaid.render` to generate an SVG from a user-provided string and then directly injected this SVG into the DOM using `innerHTML`. This was particularly dangerous because the global Mermaid configuration was set to `securityLevel: "loose"`, which explicitly allows JavaScript event handlers (like `click`) within the diagram. An attacker could craft a markdown field with a malicious Mermaid diagram containing a JavaScript payload, leading to a stored Cross-Site Scripting (XSS) vulnerability. When any user viewed the page with this markdown, the malicious script would execute in their browser context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.