CVE-2026-102356

The Kroki diagram creation tool is vulnerable to Server-Side Request Forgery (SSRF) in the optional Mermaid companion. Specifically, the mermaid/src/worker.js component (versions 0.26.0 until 0.31.2 ) fails to implement a network request policy when rendering attacker-controlled flowchart image n...