Server-Side Request Forgery in Kroki Product by Yuzutech

CVE-2026-129485

What is CVE-2026-129485?

Kroki versions prior to 0.36.0 are impacted by a server-side request forgery vulnerability affecting the BlockDiag engine. This flaw allows unauthenticated attackers to exploit the node icon and background attributes to craft malicious diagrams. By making specific requests to endpoints such as /blockdiag/svg, attackers can query internal services, access cloud metadata, and read local image files on the server, resulting in a significant security risk for users of the affected version.

References