CVE-2023-27586 CRITICAL

CVE-2023-27586: CairoSVG improperly processes SVG files loaded from external resources

Vendor Kozea
Product CairoSVG
Weakness CWE-20 · Input validation
Published March 20, 2023
Last update February 25, 2025
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

What the vulnerability does

01Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Key dates

02Disclosure timeline

March 20, 2023 CVE published
February 25, 2025 Record updated