CVE-2020-10799: Improper Restriction of XML External Entity Reference in svglib
Summary
CVE-2020-10799: SVGlib Vulnerable to XXE Attacks. Affects svglib versions < 0.9.4. Fixed in 0.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
svglib is a Python package available on PyPI that provides functionality for working with SVG files. It allows users to manipulate and convert SVG files to other formats. The package is widely used in various Python applications and projects.
Vulnerability Detail
The svglib package through version 0.9.3 is vulnerable to an XML External Entity (XXE) attack. This vulnerability arises due to improper restriction of XML external entity references in the svg2rlg function. An attacker can exploit this vulnerability by crafting a malicious SVG file that includes external entity references, leading to disclosure of sensitive information or denial of service attacks.
How To Fix
Latest published version: 2.3.1 as of 22 Oct 2026
pip install --upgrade "svglib==2.3.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.4
This is the first release that contains the fix.
pip install --upgrade "svglib==0.9.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can sanitize SVG files before processing them with svglib. This can be done by removing any external entity references from the SVG file using a parser or by using a library that automatically sanitizes SVG files. Here is an example of how to sanitize an SVG file using the defusedxml library:
import defusedxml.ElementTree as ET
def sanitize_svg(svg_file):
tree = ET.parse(svg_file)
root = tree.getroot()
for elem in root.iter():
if 'external_entity_reference' in elem.attrib:
del elem.attrib['external_entity_reference']
tree.write(svg_file)
By sanitizing SVG files, the risk of XXE attacks can be mitigated.
Conclusion
The vulnerability in svglib (CVE-2020-10799) allows for XML External Entity (XXE) attacks, which can lead to disclosure of sensitive information or denial of service attacks. It is recommended to upgrade to svglib version 0.9.4 or later to fix this vulnerability. Alternatively, users can sanitize SVG files to mitigate the risk of XXE attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for svglib →
FAQ
svglib is a Python package that provides functionality for working with SVG files. It allows users to manipulate and convert SVG files to other formats.
An XML External Entity (XXE) attack is a type of attack where an attacker can exploit vulnerabilities in XML parsers to disclose sensitive information or perform denial of service attacks.
The vulnerability in svglib allows an attacker to craft malicious SVG files that can lead to disclosure of sensitive information or denial of service attacks when processed by applications using svglib.
Yes, the vulnerability can be fixed by upgrading the svglib package to version 0.9.4 or later.
Yes, users can sanitize SVG files before processing them with svglib by removing any external entity references from the files.
