CVE-2025-14896

yuzutech / kroki PUBLISHED

Description (CNA)

due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.

Affected (CNA)

Vendor / product	Versions
yuzutech / kroki	affected 0 before *

CWE

CWE-552

References

https://github.com/yuzutech/kroki/commit/f31093cd8a0a1d6999c43d560f62d1e82d59c77e

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.