Threats tagged 'ghsa-3596-jrj6-mf2p'

Kroki versions before 0.36.0 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the svg-color-dark-scheme and svg-color-light-scheme options. By crafting a specially designed GET request to the /goat/svg endpoint, attackers can close the SVG style element and execute JavaScript in the context of the Kroki origin when a victim opens the URL.