Threats tagged 'ghsa-976x-w3hh-23xw'

Kroki versions prior to 0.36.0 have a server-side request forgery (SSRF) vulnerability in the BlockDiag family of diagram engines. This flaw allows unauthenticated attackers to craft diagrams that cause the server to make arbitrary requests, including querying internal services, cloud metadata, or reading local image files. The vulnerability affects endpoints such as POST /blockdiag/svg and related ones.