Directory traversal in convert-svg-core

CRITICO 9.8CVE-2022-24278 · GHSA-5f47-rcg5-9m24 · SNYK-JS-CONVERTSVGCORE-2859830 · Published 10/06/2022 · updated 17/06/2026

In breve

CVE-2022-24278 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda convert-svg (convert-svg project), convert-svg-core.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.2%, superiore al 82.6% delle vulnerabilità.
Correzione: aggiornare a 0.6.4 o successiva.

Package	Affected versions	Patched versions
convert-svg convert-svg_project	`< 0.6.4`	`0.6.4`
convert-svg-core npm	`< 0.6.4`	`0.6.4`

Description

The package convert-svg-core before 0.6.4 is vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

NVD description

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

References

nvd.nist.gov/vuln/detail/CVE-2022-24278 · ADVISORY
neocotic/convert-svg · WEB
neocotic/convert-svg#87 · WEB
neocotic/convert-svg commit 2bbc498 · WEB
neocotic/convert-svg · PACKAGE
snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859830 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free