Kroki

v0.31.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1d Documentation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

api blockdiag bpmn bytefield c4 diagrams

+13 more

ditaa erd excalidraw graphviz images mermaid pikchr plantuml svgbob text uml umlet wavedrom

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Diagram libraries, deps, and Bookworm across a mixed release.

Full changelog

Security

Prevent TikZ diagrams in secure mode from reading arbitrary files on the container filesystem via \input, \include, \openin/\read, \lstinputlisting and similar LaTeX file-access primitives, by restricting kpathsea's openin_any/openout_any to the current working directory instead of only blocklisting \verbatiminput
Prevent Mermaid flowchart image-shape nodes (N@{ img: "URL" }) from making the companion's headless Chromium fetch an attacker-controlled URL on /svg and /png, by wiring KROKI_MERMAID_SAFE_MODE/KROKI_SAFE_MODE into a shared Puppeteer request-interception policy (applyNetworkPolicy) that restricts requests to file:/data:/same-origin plus an optional operator-configured allowlist (KROKI_MERMAID_ALLOWED_ORIGINS / KROKI_ALLOWED_ORIGINS)

Changed

Update Node.js base Docker images to 24.18 (Bookworm) (#2097)

Fixed

Cap concurrent Mermaid conversions (KROKI_MERMAID_MAX_CONCURRENCY, default 6) to bound Chromium memory usage; a burst of simultaneous requests could otherwise spin up enough renderer processes to exceed the container's memory limit and crash the service

Diagram libraries

Update Structurizr to 6.2.2 (#2099)

What's Changed

chore(renovate): track PlantUML version via dependency dashboard only by @ggrossetie in https://github.com/yuzutech/kroki/pull/2096
chore(deps): update java dependencies by @ggrossetie in https://github.com/yuzutech/kroki/pull/2100
chore(deps): update github actions (major) by @ggrossetie in https://github.com/yuzutech/kroki/pull/2101
chore(deps): update structurizr packages to v6.2.2 by @ggrossetie in https://github.com/yuzutech/kroki/pull/2099
chore(deps): update docker images by @ggrossetie in https://github.com/yuzutech/kroki/pull/2097
chore(deps): update java testing packages to v6.1.2 by @ggrossetie in https://github.com/yuzutech/kroki/pull/2098
fix(mermaid): cap concurrent conversions to bound Chromium memory usage by @ggrossetie in https://github.com/yuzutech/kroki/pull/2105

Full Changelog: https://github.com/yuzutech/kroki/compare/v0.31.1...v0.31.2

Security Fixes

Prevented TikZ diagrams in secure mode from reading arbitrary files by restricting kpathsea's openin_any/openout_any to the current working directory.
Restricted Mermaid flowchart image‑shape nodes from fetching attacker‑controlled URLs via headless Chromium using a request‑interception policy controlled by KROKI_MERMAID_SAFE_MODE/KROKI_SAFE_MODE and optional allowlist environment variables.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Kroki

Get notified when new releases ship.

About Kroki

Creates diagrams from textual descriptions!

All releases →