CVE-2025-14896: Vega SSRF Vulnerability in convert()

CVE-2025-14896 Overview

CVE-2025-14896 is a Server-Side Request Forgery (SSRF) vulnerability affecting Kroki's Vega diagram rendering component. The flaw stems from insufficient sanitization in Vega's convert() function when safeMode is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that forces the server to issue requests to arbitrary URLs, including file:// paths on the local filesystem. The vulnerability is categorized under [CWE-552: Files or Directories Accessible to External Parties] and exposes sensitive information stored on the host running Kroki.

Critical Impact
Unauthenticated attackers can read local files and reach internal network endpoints by submitting crafted Vega specifications to Kroki diagram rendering services.

Affected Products

Kroki diagram rendering service (yuzutech/kroki)
Vega specification processing component within Kroki
Deployments using Vega convert() with safeMode enabled and array-based specs

Discovery Timeline

2025-12-18 - CVE-2025-14896 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14896

Vulnerability Analysis

Kroki is an open-source service that converts textual diagram descriptions into images. It supports Vega and Vega-Lite specifications for data visualization rendering. The vulnerable code path lives in the Vega convert() routine, which is intended to sanitize external resource references when safeMode is enabled.

The sanitization logic fails to recursively inspect spec values when the spec parameter is supplied as an array. Attackers exploit this gap by nesting URL or file path references inside array structures, bypassing the safeMode protections. The server then dereferences attacker-controlled URIs during rendering, returning data from arbitrary endpoints or local files.

Root Cause

The root cause is incomplete input validation. The safeMode filter assumes a single object spec and does not traverse array elements with the same rigor. Resource loaders inside Vega subsequently treat the unsanitized values as trusted URIs and issue outbound HTTP or filesystem reads.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a Vega diagram specification through Kroki's public API endpoint. The malicious spec contains array-wrapped data loader directives pointing to file://, http://localhost, or internal cloud metadata URLs. Kroki processes the request server-side and returns the fetched content within the rendered output or error messages, exposing the data to the attacker. See the Kroki patch commit for technical details on the fix.

Detection Methods for CVE-2025-14896

Indicators of Compromise

Inbound POST requests to Kroki /vega or /vegalite endpoints containing array-structured spec payloads with url or data fields
Outbound connections from Kroki hosts to internal IP ranges, cloud metadata services (169.254.169.254), or localhost
Filesystem reads of sensitive paths such as /etc/passwd, /proc/self/environ, or application configuration files originating from the Kroki process

Detection Strategies

Inspect HTTP request bodies sent to Kroki endpoints for Vega specs containing array values with embedded URLs or file:// schemes
Correlate Kroki process network egress with allowlists of expected destinations and alert on deviations
Monitor application logs for unusual data fetch errors or unexpected response sizes from rendering operations

Monitoring Recommendations

Enable verbose logging on Kroki and forward logs to a centralized SIEM for query and retention
Track per-source request rates to diagram rendering endpoints to identify enumeration or scraping behavior
Alert on Kroki connections to RFC1918 addresses, link-local addresses, or file:// URI handlers

How to Mitigate CVE-2025-14896

Immediate Actions Required

Upgrade Kroki to the patched version that includes commit f31093cd8a0a1d6999c43d560f62d1e82d59c77e
Restrict network egress from Kroki containers to only the destinations required for legitimate rendering
Place Kroki behind an authenticated reverse proxy if it is exposed beyond trusted internal users

Patch Information

The maintainers addressed the vulnerability in the Kroki commit f31093c. The patch hardens sanitization in the Vega convert() function so that array-form specifications are recursively inspected when safeMode is enabled. Operators should rebuild or repull container images and redeploy.

Workarounds

Disable the Vega and Vega-Lite engines in Kroki configuration if they are not required by users
Run Kroki in a network namespace that blocks access to localhost, cloud metadata endpoints, and internal subnets
Apply egress filtering at the host or container level to deny file:// handler resolution and outbound requests to sensitive destinations

bash

# Configuration example: disable Vega engines in Kroki via environment variables
KROKI_VEGA_ENABLED=false
KROKI_VEGALITE_ENABLED=false

# Example Docker network restriction limiting Kroki egress
docker run --name kroki \
  --network kroki-restricted \
  -e KROKI_SAFE_MODE=secure \
  yuzutech/kroki:latest