EUVD-2025-6266

Malicious code in bioql PyPI...

@0xgg/echomd (>=1.0.0 <=1.0.4), @amcharts/amcharts4 (>=4.0.0 <=4.9.21) +252 more potentially affected by CVE-2025-25977 via canvg (>=0.0.5 <=3.0.10)

canvg NPM version =0.0.5, =1.0.0, =4.0.0, =3.8.2, =0.0.3, =1.0.0, =2.6.4, =0.0.21, =2.2.1, =1.5.3, =1.54.0, =1.95.0 and more Source cves: CVE-2025-25977 Source advisory: OSV:GHSA-V2MW-5MCH-W8C5...

CVE-2025-25977

An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...