CVE-2026-102356

The Kroki diagram creation tool is vulnerable to Server-Side Request Forgery (SSRF) in the optional Mermaid companion. Specifically, the mermaid/src/worker.js component (versions 0.26.0 until 0.31.2 ) fails to implement a network request policy when rendering attacker-controlled flowchart image n...

EUVD-2026-118388

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKISAFEMODE is set to secure. An actor who can...