CVE-2026-129484

CVSS 6.1 (medium) · published 2026-11-15

Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.

Weakness: CWE-79

Source: NVD CVE-2026-129484

References

• https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Goat.java#L61-L71
• https://github.com/yuzutech/kroki/commit/a0a1435cc38eb7b258c555a883b7687424ad6784
• https://github.com/yuzutech/kroki/releases/tag/v0.36.0
• https://github.com/yuzutech/kroki/security/advisories/GHSA-xp94-px2v-f7f2
• https://www.vulncheck.com/advisories/kroki-before-0.36.0-reflected-xss-via-goat-svg-color-scheme-options

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.