Skip to content
OpenAdvisories
Critical · 9.9 CVE-2022-25759 EUVD-2022-6244GHSA-5gxc-fxcr-9326

Remote Code Injection

Published Jul 22, 2022 · Updated Sep 16, 2024 · Assigned by snyk

Package: convert-svg-core Ecosystem: npm

Description

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.

Affected products

VendorProductAffectedFixed
— convert-svg-core unspecified – < 0.6.2 0.6.2

Affected packages

EcosystemPackageAffectedFixedRecord
npm convert-svg-core < 0.6.2 0.6.2 GHSA-5gxc-fxcr-9326

References