kroki vulnerabilities

2 known vulnerabilities in kroki from Yuzutech. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  kroki: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-102359Nov 6, 2026Yuzutech

  Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \incl

• 7.5 High severity

  kroki: Files or Directories Accessible to External Parties

  CVE-2025-14896Dec 18, 2025Yuzutech

  due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file sy