CVE-2026-102356

Name of the Vulnerable Software and Affected Versions Kroki versions 0.26.0 through 0.31.1

Description The optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, regardless of whether KROKI SAFE MODE is enabled. An actor capable of submitting Mermaid source and bypassing configured authentication or authorization can trigger the companion to issue HTTP or HTTPS GET requests when requesting PNG output. This requires the use of the Mermaid companion, PNG rendering via headless Chromium, a diagram-submission path, and network reachability from the companion to the target. The impact is limited to blind request reachability and potential state-changing GET endpoints.

Recommendations Update to version 0.31.2.