CVE-2026-32308

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32308", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T21:16:21.659Z", "datePublished": "2026-03-12T21:29:00.510Z", "dateUpdated": "2026-03-14T03:43:13.858Z"}, "containers": {"cna": {"title": "OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: \"loose\")", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh"}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"version": "< 10.0.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T21:29:00.510Z"}, "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: \"loose\" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23."}], "source": {"advisory": "GHSA-wvh5-6vjm-23qh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-14T03:42:52.550994Z", "id": "CVE-2026-32308", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-14T03:43:13.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32308", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-14T03:42:52.550994Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-14T03:43:09.143Z"}}], "cna": {"title": "OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: \"loose\")", "source": {"advisory": "GHSA-wvh5-6vjm-23qh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"status": "affected", "version": "< 10.0.23"}]}], "references": [{"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh", "name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: \"loose\" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T21:29:00.510Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32308", "state": "PUBLISHED", "dateUpdated": "2026-03-14T03:43:13.858Z", "dateReserved": "2026-03-11T21:16:21.659Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T21:29:00.510Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oneuptime", "vendor": "OneUptime", "versions": [{"status": "affected", "version": "< 10.0.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF2F89C2-1AB8-4611-9B0B-A4CFA02C807E", "versionEndExcluding": "10.0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: \"loose\" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23."}, {"lang": "es", "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. Antes de la versi\u00f3n 10.0.23, el componente visor de Markdown renderiza diagramas Mermaid con securityLevel: 'loose' e inyecta la salida SVG a trav\u00e9s de innerHTML. Esta configuraci\u00f3n permite expl\u00edcitamente enlaces de eventos interactivos en los diagramas Mermaid, lo que habilita XSS a trav\u00e9s de la directiva 'click' de Mermaid que puede ejecutar JavaScript arbitrario. Cualquier campo que renderice markdown (descripciones de incidentes, anuncios de p\u00e1ginas de estado, notas de monitores) es vulnerable. Esta vulnerabilidad se corrige en la versi\u00f3n 10.0.23."}], "id": "CVE-2026-32308", "lastModified": "2026-10-07T08:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32308", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-14T03:42:52.550994Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:42.147", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "oneuptime", "source": "cna", "vendor": "OneUptime"}, "product": "oneuptime", "vendor": "oneuptime"}], "analysis": {"en": {"generated_at": "2026-03-17T21:43:42.207552+00:00", "value": {"mitigation_remediation": ["Upgrade OneUptime to version 10.0.23 or later to remove the insecure Mermaid rendering configuration", "If an upgrade is not immediately possible, re\u2011configure the Markdown viewer to use securityLevel \"strict\" or otherwise disable Mermaid click handling", "Verify that all markdown fields (incident descriptions, status page announcements, monitor notes) are cleaned or sanitized before rendering", "Monitor user inputs and monitor for unusual XSS activity in the application logs"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution (Browser XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects OneUptime products prior to version 10.0.23. Any installation using OneUptime :oneuptime with a markdown renderer configured to securityLevel \"loose\" is affected. Upgrading to version 10.0.23 or later is required to remediate this flaw.", "description_and_impact": "OneUptime Markdown viewer renders Mermaid diagrams with securityLevel set to \"loose\" and injects the resulting SVG via innerHTML. The \"loose\" setting allows interactive event bindings, enabling a malicious click directive to execute arbitrary JavaScript. This stored XSS flaw can be leveraged to run attacker-controlled code within the browser context of any user who views a compromised field such as incident descriptions, status page announcements, or monitor notes. As a result, an attacker may exfiltrate credentials, hijack sessions, or perform further attacks against the local machine.", "risk_and_exploitability": "The CVSS base score is 7.6, indicating a high severity. The EPSS score is reported to be below 1%, suggesting low current exploitation likelihood. The vulnerability is not cataloged in the CISA KEV listings. Attackers must trick or collaborate with a user to have them view content that contains the malicious Mermaid diagram, after which arbitrary JavaScript executes in the victim\u2019s browser. The attack vector is user\u2011borne; however, the stored nature of the payload means it can persist across sessions and affect multiple users."}}}}, "created": "2026-03-13T09:49:38.725230+00:00", "updated": "2026-03-23T10:00:12.646021+00:00", "vendors": ["oneuptime", "oneuptime$PRODUCT$oneuptime"]}