Yuzutech Kroki vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Yuzutech Kroki: 1 record(s), with affected versions and fixes.

CVE-2025-14896 High · 7.5 CWE-552 Dec 18, 2025

Files or Directories Accessible to External Parties in Yuzutech Kroki

due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.