Home > Vulnerability Database > CVE-2022-25759

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2022-25759

Good to know:

Date: July 22, 2022

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.

Language: JS

Severity Score

9.9

Related Resources (6)

Url: https://github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e6efe7a5

Url: https://github.com/neocotic/convert-svg

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-25759

Url: https://github.com/neocotic/convert-svg/issues/81

Url: https://github.com/neocotic/convert-svg/pull/82

Url: https://www.mend.io/vulnerability-database/CVE-2022-25759

Severity Score

9.9

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Top Fix

Upgrade Version

Upgrade to version convert-svg-core - 0.6.2

CVSS v3.1

Base Score:	9.9
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us