CVE-2026-32308

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

• CWE-79

• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qhExploit, Mitigation, Vendor Advisory

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32301Centrifugo is an open-source scalable real-time messaging se…9.3
• CVE-2026-32302OpenClaw is a personal AI assistant. Prior to 2026.3.11, bro…8.1
• CVE-2026-32303Cryptomator encrypts data being stored on cloud infrastructu…5.9
• CVE-2026-32304Locutus brings stdlibs of other programming languages to Jav…9.8
• CVE-2026-32305Traefik is an HTTP reverse proxy and load balancer. Versions…5.3
• CVE-2026-32306OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-32309Cryptomator encrypts data being stored on cloud infrastructu…7.5
• CVE-2026-3231The Checkout Field Editor (Checkout Manager) for WooCommerce…7.2
• CVE-2026-32310Cryptomator encrypts data being stored on cloud infrastructu…5.3
• CVE-2026-32311Flowsint is an open-source OSINT graph exploration tool desi…9.8
• CVE-2026-32312GLPI is a free asset and IT management software package. In …4.3
• CVE-2026-32313xmlseclibs is a library written in PHP for working with XML …8.2