CVE-2026-32308: OneUptime Stored XSS via Mermaid Diagram Rendering
Summary
CVE-2026-32308: OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose"). Affects oneuptime versions < 10.0.23. Fixed in 10.0.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is an open-source incident management platform that helps teams manage incidents and maintain system reliability. It features a Markdown viewer component that allows users to create and view incident notes, status page announcements, and monitor descriptions. However, due to a misconfiguration in the Mermaid diagram rendering, the platform is vulnerable to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the Markdown viewer component rendering Mermaid diagrams with a security level set to 'loose'. This configuration allows interactive event bindings, enabling attackers to inject malicious JavaScript through the SVG output. The SVG is injected directly into the DOM using innerHTML, which can execute arbitrary JavaScript when users interact with the rendered diagrams. This poses a significant risk as it can lead to cookie theft and unauthorized actions on behalf of the user.
How To Fix
Latest published version: 4.0.69 as of 23 Oct 2026
npm install oneuptime@4.0.69Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.23
This is the first release that contains the fix.
npm install oneuptime@10.0.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Mermaid diagrams in any markdown-rendered fields until the package is updated. This will prevent the execution of any potentially malicious scripts.
Conclusion
The stored XSS vulnerability in OneUptime due to the loose security configuration of Mermaid diagram rendering poses significant risks. It is crucial to update to the patched version and implement the recommended fixes to safeguard against potential attacks.
See every vulnerability recorded for oneuptime →
FAQ
The vulnerability allows for stored XSS attacks, which can lead to cookie theft and unauthorized actions performed in the context of the affected user.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
Yes, the vulnerability can be fixed by updating the OneUptime package to version 10.0.23 or later.
If an immediate update is not possible, refrain from using Mermaid diagrams in markdown-rendered fields as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for oneuptime.
