CVE Feed

    Dashboard / CVE / CVE-2026-32308

    CVE-2026-32308

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

    Published:Mar 12, 2026
    Last Modified:Mar 23, 2026
    EPS:Mar 12, 2026
    EPSS Score:0.0004
    CVSS Score:7.6

    Affected Products

    Vendor
    Hackerbay
    Product
    Oneuptime
    Vendor
    Oneuptime
    Product
    Oneuptime

    Exploits

    https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh

    Related CVEs

    CVE-2026-80350 (CVSS 7.1) — OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of …
    CVE-2026-35053 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker servic…
    CVE-2026-34840 (CVSS 8.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML …
    CVE-2026-34759 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notifica…
    CVE-2026-34758 (CVSS 9.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated a…
    CVE-2026-33396 (CVSS 9.9) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged …
    CVE-2026-33142 (CVSS 8.1) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE…
    CVE-2026-33143 (CVSS 8.7) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp PO…
    CVE-2026-32598 (CVSS 6.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow…
    CVE-2026-32306 (CVSS 9.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregati…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High