OneUptime Markdown viewer renders Mermaid diagrams with securityLevel set to "loose" and injects the resulting SVG via innerHTML. The "loose" setting allows interactive event bindings, enabling a malicious click directive to execute arbitrary JavaScript. This stored XSS flaw can be leveraged to run attacker-controlled code within the browser context of any user who views a compromised field such as incident descriptions, status page announcements, or monitor notes. As a result, an attacker may exfiltrate credentials, hijack sessions, or perform further attacks against the local machine.

The vulnerability affects OneUptime products prior to version 10.0.23. Any installation using OneUptime :oneuptime with a markdown renderer configured to securityLevel "loose" is affected. Upgrading to version 10.0.23 or later is required to remediate this flaw.

The CVSS base score is 7.6, indicating a high severity. The EPSS score is reported to be below 1%, suggesting low current exploitation likelihood. The vulnerability is not cataloged in the CISA KEV listings. Attackers must trick or collaborate with a user to have them view content that contains the malicious Mermaid diagram, after which arbitrary JavaScript executes in the victim’s browser. The attack vector is user‑borne; however, the stored nature of the payload means it can persist across sessions and affect multiple users.