Yuzutech Kroki up to 0.35.x BlockDiag Engine /blockdiag/svg background server-side request forgery

Summaryinfo

A vulnerability labeled as problematic has been found in Yuzutech Kroki up to 0.35.x. Affected is an unknown function of the file /blockdiag/svg of the component BlockDiag Engine. Executing a manipulation of the argument Background can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-129485. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Yuzutech Kroki up to 0.35.x. It has been declared as problematic. This vulnerability affects an unknown part of the file /blockdiag/svg of the component BlockDiag Engine. The manipulation of the argument background with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. CVE summarizes:

Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-129485 since 11/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.36.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-126082). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Yuzutech

Name

• Kroki

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35

Website

• Product: https://github.com/yuzutech/kroki/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion