CVE-2022-25759: Remote Code Injection in convert-svg-core
Summary
CVE-2022-25759: convert-svg-core vulnerable to remote code injection. Affects convert-svg-core versions < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
convert-svg-core is an npm package used for converting SVG files to other formats. It is commonly used in web development projects to manipulate and convert SVG images. However, versions before 0.6.2 of convert-svg-core are vulnerable to remote code injection. This vulnerability allows an attacker to execute arbitrary code by sending an SVG file containing a payload in the onload attribute. When processed by Puppeteer/Chromium (which is used by convert-svg-core), the code within the onload attribute is executed, including any malicious code.
Vulnerability Detail
The remote code injection vulnerability in convert-svg-core poses a significant security risk. An attacker can craft a malicious SVG file with a payload in the onload attribute, which will be executed when the file is processed by convert-svg-core. This allows the attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further exploitation of the system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 0.7.1 as of 23 Oct 2026
npm install convert-svg-core@0.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.2
This is the first release that contains the fix.
npm install convert-svg-core@0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating convert-svg-core is not immediately feasible, a possible workaround is to implement input validation and sanitization for SVG files. This can help mitigate the risk of remote code injection by blocking or neutralizing malicious payloads. Here is an example of how to sanitize SVG files using the DOMPurify library:
const DOMPurify = require('dompurify');
const svgFile = '...'; // SVG file content
const sanitizedSvg = DOMPurify.sanitize(svgFile);
// Use the sanitizedSvg in convert-svg-core
Conclusion
The remote code injection vulnerability in convert-svg-core (CVE-2022-25759) poses a critical security risk. It allows an attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further exploitation. It is crucial to update convert-svg-core to version 0.6.2 or later to fix this vulnerability. Implementing input validation and sanitization for SVG files can provide additional protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for convert-svg-core →
FAQ
convert-svg-core is an npm package used for converting SVG files to other formats. It is commonly used in web development projects.
Remote code injection is a vulnerability that allows an attacker to execute arbitrary code on a target system by injecting malicious code through a vulnerable application or service.
The vulnerability in convert-svg-core is triggered when an SVG file with a payload in the onload attribute is processed. Puppeteer/Chromium, which is used by convert-svg-core, executes the code within the onload attribute, including any malicious code.
The remote code injection vulnerability in convert-svg-core can lead to unauthorized access, data breaches, and further exploitation of the target system. An attacker can execute arbitrary code, potentially compromising the integrity, confidentiality, and availability of the system.
To protect your application, it is recommended to update convert-svg-core to version 0.6.2 or later. Additionally, implementing input validation and sanitization for SVG files can help mitigate the risk of remote code injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for convert-svg-core.
