Insufficient Sanitization in Vega's Convert Function Exposes Sensitive Data
CVE-2025-14896

8.7HIGH

Key Information:

Vendor

Yuzutech

Status
Kroki
Vendor
CVE Published:
18 December 2025

What is CVE-2025-14896?

A vulnerability exists in Vega's convert() function, specifically when safeMode is enabled and the spec variable is an array. This flaw allows attackers to craft malicious Vega diagram specifications. Such crafted specifications can manipulate requests to target any URL, including potentially sensitive local file system paths. Consequently, this could lead to unauthorized access to sensitive information stored on affected systems.

Affected Version(s)

kroki 0

References

https://github.com/yuzutech/kroki/commit/f31093cd8a0a1d69...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Catalin Iovita (Snyk Security Research)
JSON
.
CVE-2025-14896 : Insufficient Sanitization in Vega's Convert Function Exposes Sensitive Data