What is the CVSS score of CVE-2026-32308?

CVE-2026-32308 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oneuptime are affected by CVE-2026-32308?

CVE-2026-32308 is a stored cross-site scripting vulnerability in OneUptime that could allow authenticated users to inject malicious code through markdown fields, potentially compromising other users'…. A patch is available.

How to fix or mitigate CVE-2026-32308?

Within 24 hours: Inventory all OneUptime instances and confirm versions affected (pre-10.0.23). Within 7 days: Implement input validation and output encoding controls for markdown fields; restrict markdown/Mermaid diagram rendering to trusted users only; enable audit logging for markdown field modifications. Within 30 days: Contact OneUptime vendor for patch availability timeline; plan and execute upgrade to version 10.0.23 or later; conduct security awareness training for users on the risks of untrusted content in collaborative platforms.

Oneuptime CVE-2026-32308

EUVD-2026-11720 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 security-advisories@github.com

GHSA-wvh5-6vjm-23qh

XSS Oneuptime

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-11720

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:54 nvd

HIGH 7.6

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. This vulnerability is fixed in 10.0.23.

AnalysisAI

Cross-site scripting (XSS) vulnerability in OneUptime monitoring platform versions prior to 10.0.23, where the Markdown viewer component renders Mermaid diagrams with insecure settings that allow arbitrary JavaScript execution. An authenticated attacker with low privileges can inject malicious JavaScript through any markdown field (incident descriptions, status pages, monitor notes), potentially compromising other users' sessions. With an EPSS score of only 0.03% and no KEV listing, this appears to be a theoretical risk with no observed exploitation in the wild.

Technical ContextAI

The vulnerability stems from OneUptime's Markdown viewer component using Mermaid (a diagramming library) with securityLevel set to 'loose' and injecting SVG output via innerHTML. This configuration explicitly enables interactive event bindings through Mermaid's 'click' directive, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability affects the OneUptime monitoring and management platform, which is used for tracking online service availability and incidents. The root cause is insufficient input sanitization combined with unsafe rendering practices for user-controlled markdown content.

RemediationAI

Update OneUptime to version 10.0.23 or later, which contains the fix for this vulnerability. The patch is available at https://github.com/OneUptime/oneuptime/releases/tag/10.0.23. As a temporary mitigation, organizations could restrict markdown editing permissions to trusted users only or disable Mermaid diagram rendering if not required. Review and sanitize any existing markdown content that may contain malicious Mermaid click directives.