CVE-2023-27586

Katalog CVE

CVSS 7.1 · High EPSS 0,72%

Kerentanan Improper Input Validation pada courtbouillon cairosvg. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Rincian

Terbit di NVD

20 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv advisory vendor
• https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255 patch
• https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53 patch
• https://github.com/Kozea/CairoSVG/releases/tag/2.7.0 release notes