MEDIUMCVSS 6.1
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.
Published 2026-11-15 · last modified 2026-11-15
← Get alerted the moment a CVE hits your gear — subscribe freeNcerio by BeyondNets · data from NVD, CISA KEV, EPSS.