ReDOS in IS-SVG

高危 7.5CVE-2021-29059 · GHSA-r8j5-h5cx-65gg · Published 21/06/2021 · updated 17/06/2026

要点

CVE-2021-29059 是影响 is-svg (is-svg project), is-svg 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.6%，高于 85.6% 的漏洞。
修复：升级到 4.3.0 或更高版本。

Package	Affected versions	Patched versions
is-svg is-svg_project	`≥ 2.1.0, < 4.3.0`	`4.3.0`
is-svg npm	`≥ 2.1.0, < 4.3.0`	`4.3.0`

Description

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

NVD description

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

References

nvd.nist.gov/vuln/detail/CVE-2021-29059 · ADVISORY
sindresorhus/is-svg commit 732fc72 · WEB
sindresorhus/is-svg · PACKAGE
sindresorhus/is-svg release v4.3.0 · WEB
yetingli/PoCs · WEB
yetingli/SaveResults · WEB
npmjs.com/package/is-svg · WEB

is-svg 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free