cve.bz

yuzutech kroki vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.3CVE-2026-129447

    Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup co…

  2. 7.5CVE-2026-102359EPSS 0.4%

    Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \re…

  3. 5.0CVE-2026-102356EPSS 0.2%

    Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, eve…

  4. 8.7CVE-2025-14896EPSS 0.3%

    due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, in…