CVE-2022-24278: Directory-traversal in convert-svg-core

June 11, 2022 (updated June 17, 2022)

The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

References

github.com/advisories/GHSA-5f47-rcg5-9m24
github.com/neocotic/convert-svg/commit/2bbc498c5029238637206661dbac9e44d37d17c5
github.com/neocotic/convert-svg/issues/86
github.com/neocotic/convert-svg/pull/87
nvd.nist.gov/vuln/detail/CVE-2022-24278
snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859830

Code Behaviors & Features

Detect and mitigate CVE-2022-24278 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →