Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Convert-svg-core Project Component: Convert-svg-core Clear all filters
TI-2022-09333 CVE-2022-25759 · GHSA-5gxc-fxcr-9326

Remote code injection in convert-svg-core

Priority MEDIUM 56

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.11548 Published 2022-07-22 Fixed in 0.6.2 CWE-94
TI-2022-08303 CVE-2022-24429 · GHSA-54px-mhwv-5v8x

Arbitrary code injection in convert-svg-core

Priority LOW 36

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00914 Published 2022-06-10 Fixed in 0.6.3 CWE-94
TI-2021-06172 CVE-2021-23631 · GHSA-jv7g-9g6q-cxvw

Directory traversal in convert-svg-core

Priority LOW 37

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01978 Published 2022-01-21 No fix listed CWE-22