In short
- CVE-2022-24429 is a HIGH (CVSS 7.8) vulnerability affecting convert-svg-core (convert-svg-core project), convert-svg-core.
- Chance of exploitation in the next 30 days (EPSS): 0.91%, higher than 60.1% of all vulnerabilities.
- Fix: update to 0.6.3 or later.
Description
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
NVD description
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
More vulnerabilities in convert-svg-core
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free