CVE-2026-102356

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2.

• CWE-918

• https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82
• https://github.com/yuzutech/kroki/releases/tag/v0.31.2
• https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10234A vulnerability was detected in Mettle sendportal up to 3.0.…3.5
• CVE-2026-102340Telepresence enables local development against a remote Kube…8.5
• CVE-2026-102342ammonia is a Rust library for repairing and securing untrust…5.4
• CVE-2026-102345Zammad is a web based open source helpdesk/customer support …5.1
• CVE-2026-10235A flaw has been found in CodeAstro Ingredients Stock Managem…6.3
• CVE-2026-102354BentoPDF is a privacy-focused PDF toolkit that runs in the b…6.8
• CVE-2026-102359Kroki creates diagrams from textual descriptions. Prior to 0…7.5
• CVE-2026-10236A vulnerability has been found in SourceCodester Water Billi…7.3
• CVE-2026-102360A missing bounds check in the binary decoder in lib0, versio…8.6
• CVE-2026-102361mall4j through 4.0 contains a missing authentication vulnera…9.1
• CVE-2026-102362mall4j through 4.0 fails to implement authentication control…5.3
• CVE-2026-102363mall4j through 4.0 contains a missing authentication vulnera…3.7