Oneuptime EUVD-2026-11720

OneUptime versions prior to 10.0.23 with Markdown viewer rendering any user-controlled content (incident descriptions, status page announcements, monitor notes) using Mermaid with securityLevel set to 'loose'. Authenticated user access required to input malicious markdown; victim user must view the rendered content.

Despite the high CVSS score of 7.6, the real-world risk appears moderate. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates network-accessible with low complexity but requires authentication (PR:L) and user interaction (UI:R). The extremely low EPSS score of 0.03% (9th percentile) suggests minimal exploitation probability. The vulnerability is not listed in CISA KEV, indicating no known active exploitation. The 'Changed Scope' (S:C) elevates the CVSS score but the practical impact is limited to authenticated contexts. This is a priority for organizations using OneUptime but not a critical emergency given the authentication requirement and lack of wild exploitation.

An authenticated attacker with basic user privileges creates or edits content containing markdown (such as an incident report or status page update) and embeds a malicious Mermaid diagram with a click directive like 'click A javascript:alert(document.cookie)'. When another user views this content, the JavaScript executes in their browser context, potentially stealing session tokens or performing actions on their behalf. No public proof-of-concept exists, but the attack is straightforward given the documented vulnerability details.