CVE-2026-129447: Kroki before 0.36.0 Reflected XSS via DBML Table URLs
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Kroki versions before 0.36.0 are affected. The vulnerable functionality is the /dbml/svg endpoint.
What does exploitation require?
An unauthenticated attacker can create a crafted SVG link using DBML table URL, headercolor, or TableGroup color settings. JavaScript executes only after a user opens the generated SVG and clicks the table header.
Are unauthenticated users exposed?
Yes. The vulnerable endpoint can be reached by unauthenticated attackers, although successful exploitation requires user interaction with the crafted SVG.
What should be done if patching is not immediately possible?
Limit or disable access to the /dbml/svg endpoint where possible, especially for untrusted DBML input. Avoid opening SVG output generated from untrusted DBML and do not click table headers in suspicious diagrams.