CVE-2026-102359

Full vulnerability record from the local CVENow database.

Description

Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \verbatiminput while allowing native TeX file-read primitives including \openin, \read, \input, and \include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 18:17:37.110000

Last modified

2026-11-06 18:17:37.110000

View original CVE JSON

{
  "id": "CVE-2026-102359",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T18:17:37.110",
  "lastModified": "2026-11-06T18:17:37.110",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "yuzutech",
          "product": "kroki",
          "versions": [
            {
              "version": "< 0.31.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/yuzutech/kroki/releases/tag/v0.31.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw",
      "source": "[email protected]"
    }
  ]
}