EUVD-2026-126082

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to que...

CVE-2026-129485

Kroki versions prior to 0.36.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the BlockDiag engine family. Unauthenticated attackers can exploit node icon and background attributes by sending crafted diagrams to the POST /blockdiag/svg endpoint or related sibling endp...