GitHub Advisoryadvisory · npm

GHSA-54px-mhwv-5v8x Code injection via SVG file in convert-svg-core

HIGH Published 2022-06-11 Modified 2022-06-17 Official page ↗
Aliases
CVE-2022-24429
Ecosystem
npm
Packages
convert-svg-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-74, CWE-94
Reviewed
2022-06-17

Affected packages

• npm convert-svg-core: < 0.6.3 → fixed in 0.6.3

Description

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.

Related

Alias · CVE (1)

  • CVE-2022-24429 The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References