Skip to content
OpenAdvisories

Product · yuzutech

kroki

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-129447

    Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unaut…

    yuzutech kroki
  • Medium 5.0
    CVE-2026-102356

    Kroki Mermaid companion SSRF via flowchart image URLs

    Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MO…

    yuzutech kroki