Executive brief
OneUptime is an incident management and monitoring platform that allows teams to document incidents with markdown-formatted notes and diagrams. The application renders Mermaid diagrams with insecure settings that permit embedded JavaScript execution, allowing an authenticated attacker to inject malicious code that executes in the browsers of anyone viewing the affected content. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of viewing users.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the MarkdownViewer component that renders Mermaid diagrams. The root cause is twofold: (1) Mermaid is initialized with securityLevel set to "loose", which explicitly enables interactive event bindings and click directives in diagrams, and (2) the rendered SVG output is injected directly into the DOM via innerHTML without sanitization. An authenticated attacker can craft a Mermaid diagram containing a click directive with a JavaScript callback URL (e.g., `javascript:fetch(...)`) that executes when any user views the diagram. The vulnerability affects all markdown-rendered fields including incident notes, status page announcements, and monitor descriptions. The attack requires authentication and user interaction (viewing the diagram), but impacts all users who view the malicious content. Patched in version 10.0.23, which changes the security level to "strict" and applies DOM sanitization.
Affected products
- OneUptime OneUptime < 10.0.23
Timeline
- 2026-03-13: disclosed
- 2026-03-13: patched: Fixed in version 10.0.23