En resumen
- CVE-2025-25977 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a canvg (canvg), canvg.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.71%, mayor que el 53.9% de las vulnerabilidades.
- Solución: actualizar a 4.0.3, 3.0.11 o posterior.
| Package | Affected versions | Patched versions |
|---|
| canvg | ≥ 4.0.0, < 4.0.3< 3.0.11
| 4.0.33.0.11
|
| canvg npm | ≥ 4.0.0, < 4.0.3< 3.0.11
| 4.0.33.0.11
|
Description
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.
NVD description
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free