CVE-2022-25759: Improper Control of Generation of Code ('Code Injection')

July 22, 2022 (updated July 25, 2022)

The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload.

References

github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e6efe7a5
github.com/neocotic/convert-svg/issues/81
github.com/neocotic/convert-svg/pull/82
nvd.nist.gov/vuln/detail/CVE-2022-25759
security.snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2849633

Code Behaviors & Features

Detect and mitigate CVE-2022-25759 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →