CVE-2022-24429

Name of the Vulnerable Software and Affected Versions convert-svg-core versions prior to 0.6.3

Description The issue allows for Arbitrary Code Injection when a specially crafted SVG file is used. An attacker can read arbitrary files from the file system and then display the file content as a converted PNG file.

Recommendations For versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of specially crafted SVG files until a patch is applied. Avoid using the convert-svg-core package with untrusted SVG files until the issue is resolved.