CVE-2026-129447

Name of the Vulnerable Software and Affected Versions Kroki versions prior to 0.36.0

Description A reflected cross-site scripting issue exists in the '/dbml/svg' endpoint. Unauthenticated attackers can inject javascript: hyperlinks by providing specially crafted values for the url, headercolor, or TableGroup color settings within a DBML table. This allows the execution of arbitrary JavaScript in the Kroki origin when a victim opens a crafted SVG link and clicks the table header.

Recommendations Update to version 0.36.0 or later. As a temporary mitigation, restrict access to the '/dbml/svg' endpoint.