CVE-2022-24429: Code Injection via SVG file in convert-svg-core
Summary
CVE-2022-24429: Code injection via SVG file in convert-svg-core. Affects convert-svg-core versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
convert-svg-core is an npm package that provides functionality for converting SVG files to other formats, such as PNG. It is widely used in various applications for handling SVG files. However, versions before 0.6.3 of convert-svg-core are vulnerable to an Arbitrary Code Injection vulnerability. This vulnerability allows an attacker to inject and execute arbitrary code by providing a specially crafted SVG file. By exploiting this vulnerability, an attacker can read arbitrary files from the file system and display the file content as a converted PNG file.
Vulnerability Detail
The vulnerability in convert-svg-core arises from insufficient input validation when processing SVG files. By manipulating certain elements or attributes within the SVG file, an attacker can inject malicious code that gets executed during the conversion process. This can lead to unauthorized access to sensitive files on the server and potential remote code execution. The impact of this vulnerability is significant as it allows an attacker to execute arbitrary code with the privileges of the application or user running the convert-svg-core package.
How To Fix
Latest published version: 0.7.1 as of 23 Oct 2026
npm install convert-svg-core@0.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.3
This is the first release that contains the fix.
npm install convert-svg-core@0.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using convert-svg-core for processing untrusted SVG files until the package is updated to a secure version. If SVG file conversion is necessary, consider using alternative packages or implementing strict input validation and sanitization measures to mitigate the risk of code injection.
Conclusion
The vulnerability in convert-svg-core allows for arbitrary code injection when processing SVG files. Upgrading to version 0.6.3 or later of convert-svg-core is recommended to mitigate this vulnerability. Developers should also regularly update their dependencies to stay protected against known vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for convert-svg-core →
FAQ
convert-svg-core is an npm package used for converting SVG files to other formats, such as PNG.
This vulnerability allows an attacker to execute arbitrary code and read arbitrary files from the file system, potentially leading to unauthorized access and remote code execution.
To fix this vulnerability, upgrade convert-svg-core to version 0.6.3 or later and ensure regular updates of dependencies.
As a temporary workaround, avoid using convert-svg-core for processing untrusted SVG files or implement strict input validation and sanitization measures.
There is currently no known exploit publicly available for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for convert-svg-core.
