MEDIUM
GHSA-4p8j-vhjm-6pvw
TCPDF lacks SVG sanitization
Quick fix
GHSA-4p8j-vhjm-6pvw — tecnickcom/tcpdf: upgrade to the fixed version with the command below.
composer require tecnickcom/tcpdf:^6.8.0Details
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/tecnickcom/tcpdf
Introduced in:
0Fixed in: 6.8.0Fix
composer require tecnickcom/tcpdf:^6.8.0References
- https://nvd.nist.gov/vuln/detail/CVE-2024-56519[ADVISORY]
- https://github.com/tecnickcom/TCPDF/commit/c9f41cbb84880bdb4fc3e0a9d287214d1ac4d7f4[WEB]
- https://github.com/tecnickcom/TCPDF[PACKAGE]
- https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0[WEB]
- https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html[WEB]
- https://tcpdf.org[WEB]