A critical information disclosure vulnerability in Yuzutech Kroki allows unauthenticated attackers to access sensitive local files through maliciously crafted Vega diagrams.

The vulnerability arises from insufficient sanitization in the convert() function when safeMode is active and the spec variable is an array. This allows an unauthenticated attacker to bypass security controls and trigger server-side requests to internal or local resources.

The ability to access local file system paths via a web-based interface poses a severe risk to organizational confidentiality. An attacker could exfiltrate sensitive configuration files, credentials, or internal data, leading to a complete compromise of the affected server. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exposure.

Immediate Action: Review the provided commit reference and apply the corresponding fix to your deployment, as specific versioned patches may be in development by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious outbound requests from the Kroki service to local file paths or unexpected internal network segments.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming Vega diagram specifications that contain suspicious URL patterns or file access attempts.

Public Exploit Available: No

This vulnerability represents a significant security risk due to its potential for unauthorized information disclosure. Organizations currently running Yuzutech Kroki should prioritize restricting network access to the service and applying the upstream fix as soon as it is integrated into a stable release. Failure to address this flaw could allow attackers to bypass standard perimeter security to access sensitive data stored on the host system.