Skip to content
OpenAdvisories

Vendor

yuzutech

3 known vulnerabilities.

Products

kroki 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.0
    CVE-2026-102356

    Kroki Mermaid companion SSRF via flowchart image URLs

    Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MO…

    yuzutech kroki