Skip to content
OpenAdvisories

Package · Debian

cairosvg

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    CVE-2026-107378

    CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

    CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and res…

    Kozea CairoSVG cairosvg cairosvg Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-31899 Public exploit

    CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

    CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

    Kozea CairoSVG cairosvg cairosvg Debian Ubuntu Alpine PyPI
  • Critical 9.9
    CVE-2023-27586

    CairoSVG improperly processes SVG files loaded from external resources

    CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-sid…

    Kozea CairoSVG cairosvg cairosvg Debian Ubuntu Alpine PyPI
  • Medium 5.7
    CVE-2021-21236

    Regular Expression Denial of Service in CairoSVG

    CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular …

    Kozea CairoSVG cairosvg cairosvg Debian Ubuntu Alpine PyPI