{"id":"CVE-2026-102359","kind":"vulnerability","aliases":["CVE-2026-102359"],"related":[],"title":"Kroki: crafted LaTeX lets unauthenticated users read container files","description":"Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2.","summary":"Kroki turns text into diagrams, and its TikZ renderer blocks only one LaTeX file-read command when safe mode is on. An unauthenticated attacker can submit crafted LaTeX to read any file the Kroki container can access, such as mounted secrets or private keys, and receive the contents inside the returned SVG.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","kroki","package","self-hosted","tikz"],"not_affected_if":["auth-required","internal-only"],"how_to_check":"- Check the running Kroki version and whether it is below `0.31.2`.\n- Check whether the TikZ backend is exposed, for example `POST /tikz/svg` reachable from outside your network.\n- Check whether `KROKI_SAFE_MODE` is enabled; the sources say the flaw sits in the safe-mode guard.","fix":"- Kroki: upgrade to `0.31.2`.","status":"open","published_at":"2026-11-06T18:17:37+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","triaged_at":"2026-11-06T18:45:17+00:00","updated_at":"2026-11-06T18:45:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T18:45:17Z","model":"claude-haiku-5-5","output":{"fix":"- Kroki: upgrade to `0.31.2`.","reach":"internet","title":"Kroki: crafted LaTeX lets unauthenticated users read container files","impact":"high","summary":"Kroki turns text into diagrams, and its TikZ renderer blocks only one LaTeX file-read command when safe mode is on. An unauthenticated attacker can submit crafted LaTeX to read any file the Kroki container can access, such as mounted secrets or private keys, and receive the contents inside the returned SVG.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kroki","self-hosted","tikz","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads any file the container can access, including secrets and keys","analyst_note":"Confirm the exact TikZ safe-mode default and the Kroki release notes for 0.31.2 (linked fix page not read).","how_to_check":"- Check the running Kroki version and whether it is below `0.31.2`.\n- Check whether the TikZ backend is exposed, for example `POST /tikz/svg` reachable from outside your network.\n- Check whether `KROKI_SAFE_MODE` is enabled; the sources say the flaw sits in the safe-mode guard.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","internal-only"],"who_is_affected":"Teams running a self-hosted Kroki server with the TikZ backend reachable by untrusted users, especially with secrets or credentials mounted into the container. Deployments that do not expose the TikZ or generic diagram API to untrusted callers are less exposed, but the sources do not say how far that reduces risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4427,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102359':12A,15A '-2026':11A,14A '/tikz/svg':134C '0.31.2':84C,200C 'access':60B,148C 'activ':123C 'actor':127C 'allow':102C 'api':139C 'attack':47B 'backend':87C 'block':32B,98C 'caus':141C 'command':39B 'configur':168C 'contain':8A,58B,152C 'content':71B,156C 'craft':2A,50B,130C 'creat':77C 'credenti':170C 'cve':10A,13A 'data':169C,176C 'descript':81C 'diagram':27B,78C,138C 'disclos':165C 'docker':16B 'enabl':97C 'environ':175C 'escap':181C 'execut':185C 'file':9A,37B,55B,106C,147C,155C,192C 'file-read':36B,105C 'fix':197C 'generic':137C 'guard':90C 'host':21B 'includ':109C,114C 'input':112C 'insid':72B 'issu':195C 'key':67B,172C 'kroki':1A,17B,23B,57B,76C,93C,151C 'latex':3A,35B,51B,131C 'let':4A 'live':116C 'may':164C 'mode':42B,95C 'mount':63B,166C 'nativ':103C,191C 'no-shell-escap':178C 'one':34B 'openin':110C,119C 'oper':193C 'option':182C 'packag':18B 'permiss':118C 'post':133C 'prevent':183C 'primit':108C 'prior':82C 'privat':66B,171C 'process':174C 'read':7A,38B,53B,107C,111C,145C 'receiv':69B 'remain':122C 'render':31B,143C,158C 'restrict':189C 'return':74B,161C 'safe':41B,94C 'secret':64B,167C 'self':20B 'self-host':19B 'set':121C 'shell':180C,184C 'submit':49B,129C 'svg':75B,162C 'tex':104C,115C 'text':25B 'textual':80C 'tikz':22B,30B,86C 'tikz/tikz2svg':89C 'turn':24B 'unauthent':5A,46B,126C 'use':91C 'user':6A,153C 'verbatiminput':100C 'version':199C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Kroki server with the TikZ backend reachable by untrusted users, especially with secrets or credentials mounted into the container. Deployments that do not expose the TikZ or generic diagram API to untrusted callers are less exposed, but the sources do not say how far that reduces risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","high","kroki","package","selfhosted","tikz"],"campaign_type":null,"search_a":"'-102359':12A,15A '-2026':11A,14A 'contain':8A 'craft':2A 'cve':10A,13A 'file':9A 'kroki':1A 'latex':3A 'let':4A 'read':7A 'unauthent':5A 'user':6A","search_b":"'access':60B 'attack':47B 'block':32B 'command':39B 'contain':58B 'content':71B 'craft':50B 'diagram':27B 'docker':16B 'file':37B,55B 'file-read':36B 'host':21B 'insid':72B 'key':67B 'kroki':17B,23B,57B 'latex':35B,51B 'mode':42B 'mount':63B 'one':34B 'packag':18B 'privat':66B 'read':38B,53B 'receiv':69B 'render':31B 'return':74B 'safe':41B 'secret':64B 'self':20B 'self-host':19B 'submit':49B 'svg':75B 'text':25B 'tikz':22B,30B 'turn':24B 'unauthent':46B","search_c":"'/tikz/svg':134C '0.31.2':84C,200C 'access':148C 'activ':123C 'actor':127C 'allow':102C 'api':139C 'backend':87C 'block':98C 'caus':141C 'configur':168C 'contain':152C 'content':156C 'craft':130C 'creat':77C 'credenti':170C 'data':169C,176C 'descript':81C 'diagram':78C,138C 'disclos':165C 'enabl':97C 'environ':175C 'escap':181C 'execut':185C 'file':106C,147C,155C,192C 'file-read':105C 'fix':197C 'generic':137C 'guard':90C 'includ':109C,114C 'input':112C 'issu':195C 'key':172C 'kroki':76C,93C,151C 'latex':131C 'live':116C 'may':164C 'mode':95C 'mount':166C 'nativ':103C,191C 'no-shell-escap':178C 'openin':110C,119C 'oper':193C 'option':182C 'permiss':118C 'post':133C 'prevent':183C 'primit':108C 'prior':82C 'privat':171C 'process':174C 'read':107C,111C,145C 'remain':122C 'render':143C,158C 'restrict':189C 'return':161C 'safe':94C 'secret':167C 'set':121C 'shell':180C,184C 'submit':129C 'svg':162C 'tex':104C,115C 'textual':80C 'tikz':86C 'tikz/tikz2svg':89C 'unauthent':126C 'use':91C 'user':153C 'verbatiminput':100C 'version':199C","first_public_at":"2026-07-27T14:14:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102359","severity":null,"published_at":"2026-11-06T18:17:37+00:00","modified_at":"2026-11-06T18:17:37+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","fetched_at":"2026-11-06T18:44:08+00:00","note":null}],"documents":[{"id":88828,"url":"https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88826,"url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88830,"url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-27T14:14:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}