github yuzutech/kroki v0.35.0
on GitHub

5 hours ago

Security

  • Prevent remote code execution through Bytefield diagrams. bytefield-svg evaluates its input with sci (a Clojure interpreter) on Node.js, and the sci sandbox exposes aget, which lets a crafted diagram traverse the JavaScript prototype chain up to the Function constructor and run arbitrary JavaScript (and, in the single-executable bytefield binary, OS commands via process.binding). The bytefield process is now started with NODE_OPTIONS=--disallow-code-generation-from-strings, so its V8 context rejects new Function(...)/eval(...) and the escape no longer works, while legitimate diagrams are unaffected
  • Update Node.js to 24.22 in the companion images and the Node.js-based converters of the yuzutech/kroki image (previously 24.19), which includes the fix for the Brotli decoder vulnerability CVE-2026-111497. The vulnerable decoder was not reachable in Kroki, as no Brotli data is decompressed with node:zlib (#2243)
  • Prevent diagrams.net image-shape nodes (shape=image;image=URL) and background images, as well as Excalidraw image elements, from making the companion's headless Chromium fetch an attacker-controlled URL (server-side request forgery), by applying the request-interception policy already used by the Mermaid companion to the diagrams.net, Excalidraw and BPMN companions: requests are restricted to file:/data:/same-origin plus an optional operator-configured allowlist (KROKI_DIAGRAMSNET_ALLOWED_ORIGINS, KROKI_EXCALIDRAW_ALLOWED_ORIGINS, KROKI_BPMN_ALLOWED_ORIGINS / KROKI_ALLOWED_ORIGINS) unless the gateway runs in UNSAFE mode (KROKI_DIAGRAMSNET_SAFE_MODE, KROKI_EXCALIDRAW_SAFE_MODE, KROKI_BPMN_SAFE_MODE / KROKI_SAFE_MODE). The diagrams.net companion now also takes the safe mode from the gateway, instead of its own KROKI_SAFE_MODE environment variable, to decide whether to inline the images referenced by the diagram (#2225)
  • Reject every resource request made by Vega and Vega-Lite diagrams unless Kroki is running in UNSAFE mode, using a custom Vega loader. The existing check only looked for URLs at known locations of the specification, so a URL computed by a transform was not rejected. It was not exploitable in the published images, as the vega binary has no network or file system access (#2246)

Changed

  • Update the yuzutech/kroki base image to Ubuntu 26.04 LTS (eclipse-temurin:21.0.12.1_1-jre-resolute, previously 21.0.9_10-jre-noble), with dvisvgm 3.6 for TikZ diagrams (#2209)

Fixed

  • Fix GoAT diagrams on linux/arm64: the yuzutech/kroki arm64 image shipped an x86-64 goat binary, because it was built for the build platform instead of the target platform (#2186)
  • Fix UMLet custom drawings, rendered as java.lang.NullPointerException, and "all in one" activity and sequence elements, rendered almost empty: UMLet is now built from the upstream 15.1 sources (Kroki reported 15.1 but shipped a fork of UMLet 15.0) (#2223)
  • Stop installing a C/C++ toolchain (gcc, build-essential, ...) and development packages in the yuzutech/kroki image, pulled by a misspelled libgirepository package name (about 240 MB smaller) (#2199)
  • Report the Pikchr and GoAT versions shipped in the image in /health (and in the HTTP cache key): Pikchr reported an older pikchr.c artifact (7269f78c4a instead of 85e65b9686) and GoAT reported undefined instead of 0.5.1 (#2205)
  • Fix zombie processes piling up in the Mermaid, BPMN, Excalidraw and diagrams.net containers after a Chromium crash: tini now runs as PID 1 to reap them (#2244)
  • Fix the Excalidraw container taking 8.5 seconds to stop after its first render, and failing the conversions still loading a page at that point with a 400 error: the page and its assets are now served by a dedicated server listening on a random loopback port, which also means they are no longer exposed on port 8004 (#2247)
  • Fix the error returned when a Vega or Vega-Lite diagram references a URL: it recommended KROKI_SAFE_MODE=unsafe, which does not allow loading external resources, as the vega binary has no network or file system access. This limitation is now documented (#2246)

Diagram libraries

  • Update D2 to 0.9.0 (#2192)
  • Update erd to 0.2.2, built from the upstream release sources (Kroki reported 0.2.3 but actually shipped erd 0.2.1.0) (#2188)
  • Update PlantUML (and C4-PlantUML) to 1.2026.9 (#2190)
  • Update Vega-Lite to 6.5.0 (#2195)
  • Update bpmn-js to 18.31.1 (#2211)
  • Update Structurizr to 6.2.4 (#2216)
  • Update WaveDrom to 3.8.0 (#2217)
  • Update Mermaid to 12.3.0 (#2252)

What's Changed

Full Changelog: v0.34.0...v0.35.0

Check out latest releases or
releases around yuzutech/kroki v0.35.0

Don't miss a new kroki release

NewReleases is sending notifications on new releases.

Get notifications