Reflected Cross-Site Scripting Vulnerability in Kroki by Yuzutech

CVE-2026-129484

What is CVE-2026-129484?

Kroki versions prior to 0.36.0 are susceptible to a reflected cross-site scripting vulnerability that permits unauthorized users to inject malicious scripts. This exploit leverages unvalidated input from the svg-color-dark-scheme and svg-color-light-scheme options. Attackers can construct specific GET requests to the /goat/svg endpoint, manipulating SVG style elements to execute harmful JavaScript in the context of the Kroki origin. This can lead to significant security risks, including session hijacking and data exposure, when users inadvertently access the crafted URLs.

References