CVE-2022-24278: Directory Traversal in convert-svg-core
Summary
CVE-2022-24278: Directory traversal in convert-svg-core. Affects convert-svg-core versions < 0.6.4. Fixed in 0.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
convert-svg-core is an npm package that provides functionality for converting SVG files. It is commonly used in web development projects to manipulate and transform SVG images. The package is vulnerable to a Directory Traversal attack due to improper sanitization of SVG tags. This vulnerability allows an attacker to access files outside of the intended directory by crafting a specially crafted SVG file.
Vulnerability Detail
The vulnerability in convert-svg-core arises from a lack of proper sanitization of SVG tags. When processing an SVG file, the package fails to adequately validate and sanitize user-supplied input, allowing an attacker to include directory traversal sequences in the SVG file. By exploiting this vulnerability, an attacker can traverse the file system and access sensitive files outside of the intended directory. This could lead to unauthorized disclosure of sensitive information or potential remote code execution.
How To Fix
Latest published version: 0.7.1 as of 23 Oct 2026
npm install convert-svg-core@0.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.4
This is the first release that contains the fix.
npm install convert-svg-core@0.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the convert-svg-core package to mitigate the risk of a directory traversal attack.
Conclusion
The convert-svg-core package is vulnerable to a directory traversal attack due to improper sanitization of SVG tags. To mitigate this vulnerability, developers should upgrade to version 0.6.4 or later of the package and ensure proper validation and sanitization of SVG files. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for convert-svg-core →
FAQ
convert-svg-core is an npm package used for manipulating and converting SVG files in web development projects.
A directory traversal attack is a type of vulnerability where an attacker can access files outside of the intended directory by manipulating input to include directory traversal sequences.
This vulnerability can lead to unauthorized disclosure of sensitive information or potential remote code execution if an attacker is able to access and manipulate critical files outside of the intended directory.
To fix this vulnerability, upgrade to version 0.6.4 or later of the convert-svg-core package and ensure that all SVG files are properly validated and sanitized before processing.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the convert-svg-core package.
References
Related vulnerabilities
Recent vulnerabilities recorded for convert-svg-core.
