CVE-2026-129484 · Other
NO FIX YET · SEE WHAT TO DO
Kroki, a diagram rendering service, fails to validate the svg-color-dark-scheme and svg-color-light-scheme options on its GET /goat/svg endpoint. An attacker can craft a link whose option value closes the SVG style element, so JavaScript runs in the Kroki origin when a victim opens it.
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any team running a self-hosted Kroki instance older than 0.36.0 that is reachable by users or other systems. The exploit needs a crafted link opened by a victim, so instances not exposed to a browser-facing network and running the fixed version can skip it. Managed or fully private deployments are less exposed.
Not affected if fixed-version, not-internet-exposed
Who cares diagrams, kroki, self-hosted
kroki --version or the image tag in your deployment, and compare it with 0.36.0./goat/svg with svg-color-dark-scheme or svg-color-light-scheme parameters containing </style>.0.36.0 or later.Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.