CVE-2026-129447

Kroki versions before 0.36.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the /dbml/svg endpoint. The root cause is the improper neutralization of input, allowing unauthenticated attackers to inject javascript: hyperlinks by providing crafted DBML table url , headerco...

PT-2026-147434

Name of the Vulnerable Software and Affected Versions Kroki versions prior to 0.36.0 Description A reflected cross-site scripting issue exists in the '/dbml/svg' endpoint. Unauthenticated attackers can inject javascript: hyperlinks by providing specially crafted values for the url, headercolor, o...