yuzutech kroki vulnerabilities in 2026, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 5.3CVE-2026-129447
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup co…
- 7.5CVE-2026-102359EPSS 0.4%
Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \re…
- 5.0CVE-2026-102356EPSS 0.2%
Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, eve…