CVE-2026-129447 | Yuzutech Kroki up to 0.35.9 DBML SVG /dbml/svg url/headercolor/tablegroup_color cross site scripting

November 14, 2026 Yanac

A vulnerability classified as problematic was found in Yuzutech Kroki up to 0.35.9. Affected is an unknown function of the file /dbml/svg of the component DBML SVG Handler. Executing a manipulation of the argument url/headercolor/tablegroup_color can lead to cross site scripting.

This vulnerability appears as CVE-2026-129447. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More