VDB
Sign up
HIGH7.5

GHSA-jv7g-9g6q-cxvw

Path Traversal in convert-svg packages

Details

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/convert-svg-core
Introduced in: 0

No fixed version published yet for convert-svg-core (npm). Pin to a known-safe version or switch to an alternative.

npm/convert-svg-to-png
Introduced in: 0

No fixed version published yet for convert-svg-to-png (npm). Pin to a known-safe version or switch to an alternative.

npm/convert-svg-to-jpeg
Introduced in: 0

No fixed version published yet for convert-svg-to-jpeg (npm). Pin to a known-safe version or switch to an alternative.

References