File Reading Vulnerability in Kroki by Yuzutech

CVE-2026-102359

What is CVE-2026-102359?

Kroki allows the rendering of diagrams from textual descriptions. Prior to version 0.31.2, the TikZ backend’s security measures were inadequate, permitting the execution of native file-read commands even when KROKI_SAFE_MODE was enabled. This flaw allows an unauthenticated attacker to submit malicious LaTeX code through the API, which could lead to the exposure of any file accessible to the Kroki container user. This includes potential leaks of sensitive information such as credentials and configuration data. The issue was addressed in the update to version 0.31.2.

References