CVE-2025-25977 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

@amcharts/amcharts4 (4.9.21), @anarmawala/vite-plugin-icons (>=0.1.0, <=0.1.1) +58 more potentially affected by CVE-2025-25977 via canvg (>=3.0.0, <=3.0.10)

canvg NPM version =3.0.0, =0.1.0, =1.13.6, =0.2.2, =1.31.0, =1.19.0, =1.0.0, =8.5.1-beta, =0.1.0, =0.1.2, =10.0.1, =10.0.1, =2.0.4, =0.1.4, =0.1.5 and more Source cves: CVE-2025-25977 Source advisory: OSV:GHSA-V2MW-5MCH-W8C5...

@ts3d-hoops/web-viewer (>=2026.5.0, <=2026.6.0), @ts3d-hoops/web-viewer-components (>=2026.5.0, <=2026.6.0) +5 more potentially affected by CVE-2025-25977 via canvg (4.0.1)

canvg NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on canvg and may be impacted: - @ts3d-hoops/web-viewer =2026.5.0, =2026.5.0, =2026.5.0, =2026.5.0, =0.1.3, =1.22.9-beta.0, =1.0.9, =3.0.9 Source cves: CVE-2025-25977 Source advisory:...

CVE-2025-25977

An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...

CVE-2025-25977

CVE-2025-25977 is reported with concrete details in connected sources: canvg v4.0.2 is vulnerable via the Constructor of StyleElement, enabling arbitrary code execution with a network-accessible vector. The entry confirms the affected component (canvg) and version (4.0.2) and identifies the root ...