Arbitrary Code Injection Vulnerability in qt6-declarative Package
Summary
DEBIAN-CVE-2025-14576: Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. Affects qt6-declarative versions 6.10.2+dfsg-1 – 6.9.2+dfsg-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qt6-declarative package is part of the Qt framework, which is widely used for developing cross-platform applications with a focus on graphical user interfaces. This package specifically handles QML (Qt Modeling Language) and JavaScript components, enabling developers to create dynamic and responsive user interfaces. However, it is susceptible to a vulnerability that allows for arbitrary code execution when processing malicious SVG files, posing significant risks to applications that utilize this package.
Vulnerability Detail
The vulnerability arises from insufficient validation of node IDs within the Qt SVG module. When malicious SVG files are loaded through the VectorImage component in Qt Quick, it can lead to arbitrary QML/JavaScript code injection. Although QML execution is generally more restricted than native code execution, this vulnerability can still result in denial of service, information disclosure, or other impacts depending on the application's privilege level and data access. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid loading untrusted SVG files in your application until the package is updated. Additionally, consider implementing stricter validation checks on SVG files before processing them.
Conclusion
The qt6-declarative package has a critical vulnerability that allows for arbitrary code injection through malicious SVG files. It is essential to update to the patched version to mitigate risks. Additionally, using tools like Vulert can help monitor for vulnerabilities in your software effectively.
See every vulnerability recorded for qt6-declarative →
FAQ
The vulnerability allows for arbitrary code injection through insufficient validation of node IDs when loading malicious SVG files.
The impacts can include denial of service, information disclosure, and other security risks depending on the application's privilege level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The recommended action is to update the qt6-declarative package to version 6.10.2+dfsg-4 or later.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for qt6-declarative.
