EUVD-2026-126082

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to que...

CVE-2026-129485

Kroki versions prior to 0.36.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the BlockDiag engine family. Unauthenticated attackers can exploit node icon and background attributes by sending crafted diagrams to the POST /blockdiag/svg endpoint or related sibling endp...

CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...