Description
The Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid’s click directive which can execute arbitrary JavaScript.
Recommendation
Update the oneuptime package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.23
- Patched version(s): 10.0.23
References
Could your website be exposed too?
SmartScanner can check your website for OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw - Vulnerability
- Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated March 16, 2026