Reflected XSS in Kroki via SVG Color Scheme Options

Executive Summary

CVE-2026-129484 is a reflected cross-site scripting (XSS) vulnerability in Kroki before version 0.36.0. It allows unauthenticated attackers to inject malicious scripts via unvalidated SVG color scheme options (svg-color-dark-scheme and svg-color-light-scheme). Attackers craft a GET request to /goat/svg with a payload like </style><script>malicious code</script> to close the SVG style element and execute JavaScript in the victim's browser when they open the link.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP GET requests to /goat/svg endpoints for unvalidated svg-color-dark-scheme or svg-color-light-scheme parameters. Check if responses include unsanitized user input in SVG style elements. Monitor for unusual JavaScript execution in SVG files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of the Kroki domain when victims open a crafted URL. This could lead to session hijacking, theft of sensitive data, or redirection to malicious sites. Since no authentication is required, any user accessing the link is at risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This reflected XSS vulnerability could lead to unauthorized script execution in user browsers when accessing crafted URLs. For GDPR, this may violate Article 32 (security of processing) by exposing user data through script injection. For HIPAA, it risks unauthorized access to protected health information if exploited in healthcare systems using Kroki. Both standards require safeguards against such cross-site scripting risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kroki to version 0.36.0 or later. Block or sanitize svg-color-dark-scheme and svg-color-light-scheme parameters. Implement Content-Security-Policy headers to block scripts in SVG files. Restrict access to /goat/svg endpoints if possible.

Useful 0 Not Useful 0