CVE-2026-129447 in Kroki
Summary
by MITRE • 11/14/2026
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified in versions of Kroki prior to 0.36.0 represents a significant security flaw classified as a reflected cross-site scripting (XSS) issue within the application's SVG generation endpoint. Specifically, this weakness resides in the /dbml/svg endpoint, which processes input parameters related to diagram configuration such as table URLs, header colors, and TableGroup color settings. The core technical failure stems from insufficient sanitization of user-supplied data before it is embedded into the generated Scalable Vector Graphics output. When an attacker crafts a malicious request containing javascript: hyperlinks within these specific parameter fields, the application fails to neutralize or escape these inputs effectively. Consequently, when the resulting SVG file is rendered in a web browser and the table header component is interacted with by a victim user, the embedded script executes within the security context of the Kroki origin. This execution environment allows the malicious code to access cookies, session tokens, and other sensitive data associated with that domain, potentially leading to account hijacking or further exploitation of internal resources depending on the deployment configuration.
From an industry standard perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here is a reflected XSS attack where the malicious payload is provided via HTTP request parameters and immediately returned in the response without proper validation or encoding. In terms of tactical mapping to the MITRE ATT&CK framework, this vulnerability facilitates initial access and execution phases by allowing an attacker to inject client-side scripts that run under the trust relationship between the user's browser and the Kroki application server. The attack vector is primarily remote and unauthenticated, meaning no prior credentials are required to initiate the exploit sequence, although successful exploitation typically requires social engineering or a targeted delivery mechanism to get a victim to open the crafted SVG link and interact with it as described.
The operational impact of this vulnerability extends beyond simple script execution. Because the scripts run in the context of the Kroki origin, attackers can potentially perform actions on behalf of authenticated users if they are logged into the service at the time of exploitation. This includes reading sensitive diagram data stored or processed by the application, modifying session cookies to take over user accounts, or redirecting users to phishing sites that mimic the legitimate interface. In enterprise environments where Kroki is used for documenting system architectures with potentially confidential information, this exposure could lead to significant intellectual property leakage and compliance violations related to data protection regulations such as GDPR or HIPAA if sensitive infrastructure details are exposed through session hijacking scenarios.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade the Kroki installation to version 0.36.0 or later, where this input validation flaw has been addressed by developers implementing stricter sanitization routines for SVG generation parameters. For environments unable to patch immediately, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing javascript: URIs within query parameters related to diagram rendering. Additionally, implementing Content Security Policy headers that restrict the execution of inline scripts or limit script sources to trusted domains can mitigate the impact even if an injection attempt succeeds by preventing the browser from executing the malicious payload. Developers should also adopt input validation frameworks that enforce allow-listing for expected color codes and URL formats rather than relying on block-lists, ensuring that only syntactically valid and safe inputs are processed during SVG generation.