Flowchart rendering vulnerability in Kroki by Yuzutech
CVE-2026-102356
5MEDIUM
What is CVE-2026-102356?
Kroki, a tool that generates diagrams from text, has a vulnerability in its Mermaid companion. Versions 0.26.0 through 0.31.2 allow an attacker to submit crafted Mermaid source code, which may lead to unauthorized HTTP or HTTPS requests even when safe mode is enabled. This occurs when rendering PNG output via headless Chromium. The risk arises only when the attacker has submission capabilities and authenticated access, combined with the network reachability from the companion to the target. Although exploitation is primarily focused on blind request reachability, it does not extend to response exfiltration or unauthorized state changes. The issue has been resolved in version 0.31.2.
Affected Version(s)
kroki >= 0.26.0, < 0.31.2