Kroki Mermaid companion SSRF via flowchart image URLs

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/kroki/security/advisories/GHSA-px99-rjv4-49g8 Diğer
• github.com/…ommit/428ea380bc7db9da5c7947f908851c8461d51f82 Diğer
• github.com/yuzutech/kroki/releases/tag/v0.31.2 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:38Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-102359Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives
• 10,0 CVE-2026-71495Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
• 6,5 CVE-2026-119758ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
• 4,3 CVE-2026-123846In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
• 5,3 CVE-2026-123844In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories