CVE-2022-24278

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.4

Description The issue arises from improper sanitization of SVG tags, allowing for Directory Traversal attacks. This can be exploited by using a specially crafted SVG file.

Recommendations For versions prior to 0.6.4, update to version 0.6.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of convert-svg-core until a patch is applied. Avoid using convert-svg-core with untrusted SVG files until the issue is resolved.