Homepage

convert-svg-core@0.3.1 vulnerabilities

Supports converting SVG into another format using headless Chromium

  • latest version

    0.6.4

  • latest non vulnerable version

    0.6.4

  • first published

    7 years ago

  • latest version published

    2 years ago

  • licenses detected

  • View convert-svg-core package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the convert-svg-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Remote Code Injection

    convert-svg-core is a package that supports converting SVG into another format using headless Chromium.

    Affected versions of this package are vulnerable to Remote Code Injection via sending an SVG file containing the payload.

    How to fix Remote Code Injection?

    Upgrade convert-svg-core to version 0.6.2 or higher.

    <0.6.2
    • H
    Directory Traversal

    convert-svg-core is a package that supports converting SVG into another format using headless Chromium.

    Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

    How to fix Directory Traversal?

    Upgrade convert-svg-core to version 0.6.4 or higher.

    <0.6.4
    • H
    Arbitrary Code Injection

    convert-svg-core is a package that supports converting SVG into another format using headless Chromium.

    Affected versions of this package are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.

    How to fix Arbitrary Code Injection?

    Upgrade convert-svg-core to version 0.6.3 or higher.

    <0.6.3
    • H
    Directory Traversal

    convert-svg-core is a package that supports converting SVG into another format using headless Chromium.

    Affected versions of this package are vulnerable to Directory Traversal. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.

    How to fix Directory Traversal?

    Upgrade convert-svg-core to version 0.6.0 or higher.

    <0.6.0
    Go back to all versions of this package