Description
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | svglib | < 0.9.4 | 0.9.4 | GHSA-3vcg-8p79-jpcv |
Critical · 9.8
CVE-2020-10799
EUVD-2020-0183GHSA-3vcg-8p79-jpcvPYSEC-2020-111
SVGlib Vulnerable to XXE Attacks
Published Mar 20, 2020 · Updated Aug 4, 2024 · Assigned by mitre