Yuzutech vulnerabilities
We track 2 vulnerabilities in Yuzutech products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Yuzutech vulnerabilities
- 7.5 High severity
kroki: Improper Limitation of a Pathname to a Restricted Directory
Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \incl
- 7.5 High severity
kroki: Files or Directories Accessible to External Parties
due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file sy