CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-23631
High (7.5) in convert-svg-core project convert-svg-core. EPSS 2.0% chance of exploitation in the next 30 days.
This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.
Severity
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- convert-svg-core_project:convert-svg-core
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jv7g-9g6q-cxvw | npm | convert-svg-core | <=0.5.0 | no fix published |
| GHSA-jv7g-9g6q-cxvw | npm | convert-svg-to-png | <=0.5.0 | no fix published |
| GHSA-jv7g-9g6q-cxvw | npm | convert-svg-to-jpeg | <=0.5.0 | no fix published |