CVE-2026-129484: Reflected XSS in Kroki before 0.36.0 via /goat/svg Color Scheme Options

CVE-2026-129484 affects Kroki versions before 0.36.0. According to the source, the vulnerability enables reflected cross-site scripting (XSS) through the color scheme options of /goat/svg.