Vulnerabilidades de Yuzutech
CVEs publicadas que afetam produtos de Yuzutech: 1 registro(s), com severidade, exploração e correções.
CVE-2025-14896
Alta · 7.5
CWE-552 18/12/2025
Files or Directories Accessible to External Parties em Yuzutech Kroki
due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.