Threats tagged 'ghsa-r7q7-fpwp-8f26'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.3	CVE-2026-129447Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows Medium5.32026-11-14GCVE DatabaseCVE-2026-129447 Kroki versions before 0.36.0 have a reflected cross-site scripting (XSS) vulnerability in the /dbml/svg endpoint. This flaw allows unauthenticated attackers to inject malicious JavaScript via crafted DBML table URL parameters such as url, headercolor, or TableGroup color. When a user opens the crafted SVG link and clicks the table header, the injected script executes in the context of the Kroki origin. Report on CVE-2026-129447 Vulnerability CWE-79 #ghsa-r7q7-fpwp-8f26	GCVE Database	2026-11-14

Page 1 of 1