# CVE-2026-32308: OneUptime stored XSS in Mermaid diagram rendering

Source: https://junglewise.ai/threats/cve-2026-32308-oneuptime-stored-xss-in-mermaid-diagram-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32308 · Severity: high · CVSS 7.6 · Published 2026-03-13

OneUptime is an incident management and monitoring platform that allows teams to document incidents with markdown-formatted notes and diagrams. The application renders Mermaid diagrams with insecure settings that permit embedded JavaScript execution, allowing an authenticated attacker to inject malicious code that executes in the browsers of anyone viewing the affected content. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of viewing users.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-32308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32308 being exploited in the wild.

**How severe is CVE-2026-32308?** High severity, with a CVSS score of 7.6, published 13 March 2026.

**Which products and versions are affected?** OneUptime < 10.0.23.

**Is there a fix for CVE-2026-32308?** A patch was published on 2026-03-13: Fixed in version 10.0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32308 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-32308?** Check whether you run Hackerbay Oneuptime or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the MarkdownViewer component that renders Mermaid diagrams. The root cause is twofold: (1) Mermaid is initialized with securityLevel set to "loose", which explicitly enables interactive event bindings and click directives in diagrams, and (2) the rendered SVG output is injected directly into the DOM via innerHTML without sanitization. An authenticated attacker can craft a Mermaid diagram containing a click directive with a JavaScript callback URL (e.g., `javascript:fetch(...)`) that executes when any user views the diagram. The vulnerability affects all markdown-rendered fields including incident notes, status page announcements, and monitor descriptions. The attack requires authentication and user interaction (viewing the diagram), but impacts all users who view the malicious content. Patched in version 10.0.23, which changes the security level to "strict" and applies DOM sanitization.

## Affected products

- OneUptime OneUptime < 10.0.23

## Identifiers

- CVE-2026-32308
- GHSA-wvh5-6vjm-23qh

## Timeline

- 2026-03-13: disclosed
- 2026-03-13: patched: Fixed in version 10.0.23

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-wvh5-6vjm-23qh)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)