Reflected Cross-Site Scripting in Kroki by Yuzutech

CVE-2026-129447

What is CVE-2026-129447?

Kroki versions prior to 0.36.0 contain a reflected cross-site scripting vulnerability in the /dbml/svg endpoint. This flaw allows unauthenticated attackers to inject malicious JavaScript by crafting specific URLs that manipulate DBML table settings. When victims click on the table header, the attacker’s JavaScript executes within the context of the Kroki origin, potentially leading to data theft and further exploitation.

References