{"id":"CVE-2026-102356","kind":"vulnerability","aliases":["CVE-2026-102356"],"related":[],"title":"Kroki: Mermaid companion can be made to send blind server-side requests","description":"Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2.","summary":"Kroki's optional Mermaid companion renders attacker-supplied flowchart image nodes in headless Chromium without a request policy, even when safe mode is set. An actor who can submit Mermaid source can make the companion issue HTTP or HTTPS GET requests, with the demonstrated impact limited to blind request reachability and possibly state-changing GET endpoints.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","kroki","mermaid","other","self-hosted"],"not_affected_if":["isolated-network","no-mermaid-companion","no-png-rendering"],"how_to_check":"- Check the Kroki version in use; versions from 0.26.0 up to but not including 0.31.2 are affected.\n- Check whether the Mermaid companion is deployed and whether it renders PNG output through its headless Chromium process.\n- Check whether the companion can reach internal HTTP or HTTPS endpoints on its network.","fix":"- Move Kroki to `0.31.2` or later.","status":"open","published_at":"2026-11-06T18:17:36+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","triaged_at":"2026-11-06T18:45:22+00:00","updated_at":"2026-11-06T18:45:22+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T18:45:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move Kroki to `0.31.2` or later.","reach":"network","title":"Kroki: Mermaid companion can be made to send blind server-side requests","impact":"low","summary":"Kroki's optional Mermaid companion renders attacker-supplied flowchart image nodes in headless Chromium without a request policy, even when safe mode is set. An actor who can submit Mermaid source can make the companion issue HTTP or HTTPS GET requests, with the demonstrated impact limited to blind request reachability and possibly state-changing GET endpoints.","audience":"businesses","category":"other","nicknames":[],"who_cares":["kroki","mermaid","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker triggers blind GET requests from the companion to internal endpoints","analyst_note":"","how_to_check":"- Check the Kroki version in use; versions from 0.26.0 up to but not including 0.31.2 are affected.\n- Check whether the Mermaid companion is deployed and whether it renders PNG output through its headless Chromium process.\n- Check whether the companion can reach internal HTTP or HTTPS endpoints on its network.","plain_action":"","needs_analyst":false,"not_affected_if":["no-mermaid-companion","no-png-rendering","isolated-network"],"who_is_affected":"Deployments that run the optional Kroki Mermaid companion, render PNG output through its headless Chromium, and let users submit Mermaid source. The companion must also have network reachability to internal targets for the request to matter. Deployments without the Mermaid companion or without PNG rendering are not in the stated exposure path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4464,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102356':16A,19A '-2026':15A,18A '0.26.0':92C '0.31.2':94C,227C 'access':207C,211C 'actor':53B,126C,177C 'attack':34B,103C 'attacker-control':102C 'attacker-suppli':33B 'authent':135C 'author':137C 'avail':174C 'beyond':212C 'blind':9A,75B,193C 'caus':143C 'chang':82B,200C 'chromium':41B,110C,167C 'cloud':205C 'companion':3A,31B,62B,98C,145C,161C,183C,214C 'configur':138C 'control':104C 'creat':86C 'cve':14A,17A 'demonstr':71B,188C 'deploy':141C 'descript':90C 'diagram':87C,171C 'diagram-submiss':170C 'docker':20B 'endpoint':84B,202C 'establish':220C 'even':46B,116C 'exfiltr':204C 'exploit':157C 'fix':224C 'flowchart':36B,105C 'get':67B,83B,151C,201C 'headless':40B,109C,166C 'host':26B 'http':64B,148C 'https':66B,150C 'imag':37B,106C 'impact':72B,189C 'issu':63B,147C,222C 'kroki':1A,21B,27B,85C,118C 'limit':73B,191C 'made':6A 'make':60B 'mermaid':2A,22B,30B,57B,97C,130C,160C 'mermaid/src/worker.js':100C 'metadata':206C 'mode':49B,120C 'network':113C,179C,216C 'node':38B,107C 'option':29B,96C 'output':156C 'path':173C 'png':155C,162C 'polici':45B,115C 'port':208C 'possibl':79B,197C 'process':168C 'reachabl':77B,180C,195C,217C 'render':32B,101C,163C 'request':13A,44B,68B,76B,114C,152C,154C,194C 'requir':158C 'respons':203C 'safe':48B,119C 'satisfi':133C 'scan':209C 'secur':124C 'self':25B 'self-host':24B 'send':8A 'server':11A 'server-sid':10A 'set':51B,122C 'side':12A 'sourc':58B,131C 'state':81B,199C 'state-chang':80B,198C 'submiss':172C 'submit':56B,129C 'suppli':35B 'target':186C 'textual':89C 'version':226C 'without':42B,111C","nicknames":[],"mitigations":[],"who_affected":"Deployments that run the optional Kroki Mermaid companion, render PNG output through its headless Chromium, and let users submit Mermaid source. The companion must also have network reachability to internal targets for the request to matter. Deployments without the Mermaid companion or without PNG rendering are not in the stated exposure path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","kroki","medium","mermaid","other","selfhosted"],"campaign_type":null,"search_a":"'-102356':16A,19A '-2026':15A,18A 'blind':9A 'companion':3A 'cve':14A,17A 'kroki':1A 'made':6A 'mermaid':2A 'request':13A 'send':8A 'server':11A 'server-sid':10A 'side':12A","search_b":"'actor':53B 'attack':34B 'attacker-suppli':33B 'blind':75B 'chang':82B 'chromium':41B 'companion':31B,62B 'demonstr':71B 'docker':20B 'endpoint':84B 'even':46B 'flowchart':36B 'get':67B,83B 'headless':40B 'host':26B 'http':64B 'https':66B 'imag':37B 'impact':72B 'issu':63B 'kroki':21B,27B 'limit':73B 'make':60B 'mermaid':22B,30B,57B 'mode':49B 'node':38B 'option':29B 'polici':45B 'possibl':79B 'reachabl':77B 'render':32B 'request':44B,68B,76B 'safe':48B 'self':25B 'self-host':24B 'set':51B 'sourc':58B 'state':81B 'state-chang':80B 'submit':56B 'suppli':35B 'without':42B","search_c":"'0.26.0':92C '0.31.2':94C,227C 'access':207C,211C 'actor':126C,177C 'attack':103C 'attacker-control':102C 'authent':135C 'author':137C 'avail':174C 'beyond':212C 'blind':193C 'caus':143C 'chang':200C 'chromium':110C,167C 'cloud':205C 'companion':98C,145C,161C,183C,214C 'configur':138C 'control':104C 'creat':86C 'demonstr':188C 'deploy':141C 'descript':90C 'diagram':87C,171C 'diagram-submiss':170C 'endpoint':202C 'establish':220C 'even':116C 'exfiltr':204C 'exploit':157C 'fix':224C 'flowchart':105C 'get':151C,201C 'headless':109C,166C 'http':148C 'https':150C 'imag':106C 'impact':189C 'issu':147C,222C 'kroki':85C,118C 'limit':191C 'mermaid':97C,130C,160C 'mermaid/src/worker.js':100C 'metadata':206C 'mode':120C 'network':113C,179C,216C 'node':107C 'option':96C 'output':156C 'path':173C 'png':155C,162C 'polici':115C 'port':208C 'possibl':197C 'process':168C 'reachabl':180C,195C,217C 'render':101C,163C 'request':114C,152C,154C,194C 'requir':158C 'respons':203C 'safe':119C 'satisfi':133C 'scan':209C 'secur':124C 'set':122C 'sourc':131C 'state':199C 'state-chang':198C 'submiss':172C 'submit':129C 'target':186C 'textual':89C 'version':226C 'without':111C","first_public_at":"2026-07-27T14:13:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102356","severity":null,"published_at":"2026-11-06T18:17:36+00:00","modified_at":"2026-11-06T18:17:36+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","fetched_at":"2026-11-06T18:44:08+00:00","note":null}],"documents":[{"id":88825,"url":"https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88826,"url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88827,"url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-27T14:13:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}