CVE Intelligence

Yuzutech vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Yuzutech products: 1 record(s), with severity, exploitation and fixes.

Kroki 1

Exploited only (KEV) →

CVE-2025-14896 High · 7.5 CWE-552 Dec 18, 2025
Files or Directories Accessible to External Parties in Yuzutech Kroki
due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.