Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
ImageMagick may run unwanted commands from crafted SVG files
published 4 months ago
Summary
Versions of ImageMagick before 7.1.2-15 and 6.9.13-40 let specially crafted SVG images add hidden drawing commands that are executed when the image is processed. This could let an attacker make the server run unintended actions. Upgrade ImageMagick to the latest version or avoid processing SVG files from untrusted sources.
What to do
- Update dirk lemstra magick.net-q16-anycpu to version 14.10.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | dirk lemstra | magick.net-q16-anycpu |
< 14.10.3 Fix: upgrade to 14.10.3
|
Original advisory text
Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xpg8-7m6m-jf56. This link is maintained to preserve external references.
### Original Description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
This advisory has been withdrawn because it is a duplicate of GHSA-xpg8-7m6m-jf56. This link is maintained to preserve external references.
### Original Description
ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.
References
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf...
- https://nvd.nist.gov/vuln/detail/CVE-2026-56379
- https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decod...
- https://access.redhat.com/errata/RHSA-2026:32961
- https://access.redhat.com/security/cve/CVE-2026-56379
- https://bugzilla.redhat.com/show_bug.cgi?id=2491700
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56379.json
- https://github.com/advisories/GHSA-v772-658q-978p
Type
CWE-78OS Command Injection
CWE-116Improper Encoding or Escaping of Output
Timeline
Published23 Jun 2026
Updated24 Sep 2026
First seen24 Sep 2026
Sources
GHSA-v772-658q-978p · GHSA
Track software like this
Free during beta