CVE-2026-102359

Name of the Vulnerable Software and Affected Versions Kroki versions prior to 0.31.2

Description When KROKI SAFE MODE is enabled, the TikZ backend guard only blocks verbatiminput, leaving native TeX file-read primitives such as openin, read, input, and include active. Due to the permissive openin any setting in TeX Live, an unauthenticated actor can send crafted LaTeX to the 'POST /tikz/svg' endpoint or the generic diagram API. This allows the renderer to read any file accessible to the Kroki container user, including secrets, configuration data, credentials, private keys, or process environment data, and render the contents into the resulting SVG. The -no-shell-escape option does not restrict these native file operations.

Recommendations Update to version 0.31.2.