brander (>=0.1.6, <=0.1.9), chin-plugin-convert-svg (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2021-23631 via convert-svg-to-jpeg (>=0.3.3, <=0.4.0)

convert-svg-to-jpeg NPM version =0.3.3, =0.1.6, =0.0.1, =0.0.3, =1.1.3 - xd2svg 0.8.0 Source cves: CVE-2021-23631 Source advisory: OSV:GHSA-JV7G-9G6Q-CXVW...

CVE-2021-23631

CVE-2021-23631 affects convert-svg-core, convert-svg-to-png, and convert-svg-to-jpeg. A crafted SVG can trigger Directory Traversal via the SVG File Handler, enabling an attacker to read arbitrary filesystem files and render their contents as a PNG/JPEG image. Affected software is the entire vers...

CVE-2021-23631

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file...

convert-svg 路径遍历漏洞

convert-svg is open source series of open source software for converting SVG format files to other formats. A security vulnerability exists in convert-svg, which can be exploited by an attacker to read an arbitrary file from the filesystem via a carefully constructed SVG file and then display the...

brander (>=0.1.6, <=0.1.9), chin-plugin-convert-svg (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2021-23631 via convert-svg-to-jpeg (>=0.3.3, <=0.5.0)

convert-svg-to-jpeg NPM version =0.3.3, =0.1.6, =0.0.1, =0.0.3, =0.2.6, =0.2.21 - xd2svg 0.8.0 Source cves: CVE-2021-23631 Source advisory: SNYK:JS-CONVERTSVGTOJPEG-2348245...