KROKI · CVE-2026-129447 · Other
NO FIX YET · SEE WHAT TO DO
Kroki before 0.36.0 reflects DBML table url, headercolor, and TableGroup color values into SVG output on the /dbml/svg endpoint without proper sanitization. A victim who opens a crafted SVG link and clicks a table header runs attacker JavaScript in the Kroki origin.
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted or shared Kroki server that renders DBML diagrams through the /dbml/svg endpoint. Users who open crafted SVG links from outside the team are the ones put at risk; a Kroki instance not running DBML rendering or not exposed to untrusted users is lower risk.
Not affected if kroki-at-0.36.0-or-later, no-dbml-rendering
Who cares dbml, kroki, self-hosted
0.36.0.0.36.0 or later.Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.