Description
This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | convert-svg-core | < unspecified | unspecified |
| — | convert-svg-to-png | < unspecified | unspecified |
| — | convert-svg-to-jpeg | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | convert-svg-core | <= 0.5.0 | — | GHSA-jv7g-9g6q-cxvw |
| npm | convert-svg-to-jpeg | <= 0.5.0 | — | GHSA-jv7g-9g6q-cxvw |
| npm | convert-svg-to-png | <= 0.5.0 | — | GHSA-jv7g-9g6q-cxvw |