CVE-2022-24429: Code injection via SVG file in convert-svg-core

June 11, 2022 (updated June 17, 2022)

The package convert-svg-core before 0.6.3 is vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.

References

github.com/advisories/GHSA-54px-mhwv-5v8x
github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1
github.com/neocotic/convert-svg/issues/84
nvd.nist.gov/vuln/detail/CVE-2022-24429
snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212

Code Behaviors & Features

Detect and mitigate CVE-2022-24429 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →