EUVD-2026-118386

Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKISAFEMODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \include. TeX Live's permissive openinany...