CVE-2026-129447 json
Kroki before 0.36.0 Reflected XSS via DBML Table URLs
published 5d ago modified 17h ago also EUVD-2026-125946 , GHSA-fr36-wcx2-7gfq
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository yuzutech/kroki. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin.
Patch / fix
- yuzutech kroki 0.36.0
Is CVE-2026-129447 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- yuzutech kroki
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/yuzutech/kroki/commit/b57e1bdc39df9521b249db0dbd56c5e0a8b7e33d
patch
-
github.com
/yuzutech/kroki/security/advisories/GHSA-fr36-wcx2-7gfq
vendor-advisory, advisory
-
github.com
/yuzutech/kroki/releases/tag/v0.36.0
release-notes
-
github.com
/yuzutech/kroki/blob/v0.35.0/dbml/index.js#L13
technical-description
-
vulncheck.com
/advisories/kroki-before-0.36.0-reflected-xss-via-dbml-table-urls
third-party-advisory
Sources
- CVE List CVE-2026-129447
- NVD CVE-2026-129447
- Maintainer advisory GHSA-fr36-wcx2-7gfq
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of yuzutech/kroki published their own advisory on GitHub. Reviewed sources take precedence over it.