Description
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | convert-svg-core | unspecified – < 0.6.3 | 0.6.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | convert-svg-core | < 0.6.3 | 0.6.3 | GHSA-54px-mhwv-5v8x |