Executive brief
svg2png is a Node.js library that converts SVG images to PNG format, commonly used in web applications and image processing pipelines. An attacker can inject malicious JavaScript code within SVG documents, which gets executed when the library processes the file, potentially compromising the application and enabling further attacks on internal systems.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in svg2png versions up to 4.1.1, where the package fails to sanitize JavaScript code embedded in SVG documents before rendering them using PhantomJS. Since the rendering occurs server-side during SVG-to-PNG conversion, an attacker can inject arbitrary JavaScript that executes in the application's backend context, leading to XSS and secondary Server-Side Request Forgery (SSRF) attacks. The attack requires an attacker to supply a malicious SVG file as input, with no authentication or special preconditions. No patched version is documented in the advisory.
Affected products
- svg2png svg2png up to 4.1.1
Timeline
- 2020-04-17: disclosed
- 2022-01-06: advisory