Skip to content
OpenAdvisories

Vendor

yuzutech

3 known vulnerabilities.

Products

kroki 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-102359

    Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives

    Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \inc…

    yuzutech kroki
  • High 7.5
    CVE-2025-14896

    due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an …

    yuzutech kroki