Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2022-25759: convert-svg-core can let attackers run code
CVE-2022-25759 · published 4 years ago
Summary
The convert-svg-core library (versions before 0.6.2) can be tricked by a specially crafted SVG image to execute unwanted commands on the system that processes it. This could allow an attacker to take control of the server or access data. Upgrade to version 0.6.2 or newer, and avoid processing untrusted SVG files until the update is applied.
What to do
- Update neocotic convert-svg-core to version 0.6.2.
- Update convert-svg-core_project convert-svg-core to version 0.6.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | neocotic | convert-svg-core |
< 0.6.2 Fix: upgrade to 0.6.2
|
| – | convert-svg-core_project | convert-svg-core |
< 0.6.2 cpe:2.3:a:convert-svg-core_project:convert-svg-core:*:*:*:*:*:node.js:*:* |
Original advisory text
Remote Code Injection
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
References
- https://github.com/advisories/GHSA-5gxc-fxcr-9326
- https://security.snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2849633 URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-25759 Vendor Advisory
- https://github.com/neocotic/convert-svg/issues/81 Third Party Advisory
- https://github.com/neocotic/convert-svg/pull/82 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25759... Vendor Advisory
- https://github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-94Code Injection
Timeline
Published22 Jul 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta