Reflected XSS in Kroki Diagram Rendering Engine

Executive Summary

CVE-2026-129447 is a reflected cross-site scripting (XSS) vulnerability in Kroki versions before 0.36.0. It allows unauthenticated attackers to inject malicious JavaScript URLs into DBML diagrams via the /dbml/svg endpoint by manipulating table URLs, headercolor, or TableGroup color settings. When a victim opens the generated SVG and clicks the table header, the injected JavaScript executes within the Kroki origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Kroki instance is running a version before 0.36.0. Use the command: curl -s https://your-kroki-instance/version | grep -q "0.35.0" && echo "Vulnerable" || echo "Not vulnerable". Inspect network traffic for requests to /dbml/svg endpoints with unusual parameters like headercolor or TableGroup color containing javascript: URLs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of the Kroki application when users interact with crafted SVG diagrams. This could lead to session hijacking, data theft, or defacement of rendered diagrams. Users opening malicious links may unknowingly trigger the attack.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in user browsers. Attackers could steal session cookies, manipulate displayed data, or exfiltrate sensitive information, violating data integrity and confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kroki to version 0.36.0 or later immediately. If upgrading is not possible, apply a restrictive Content-Security-Policy header via a reverse proxy to block script execution in SVG diagrams. Disable or restrict access to the /dbml/svg endpoint if not required.

Useful 0 Not Useful 0