Executive brief
convert-svg-core is a Node.js library that converts SVG files into other image formats (PNG, JPEG, WebP) using headless Chromium. A specially crafted SVG file can be exploited to execute arbitrary code, allowing an attacker to read sensitive files from the system and display their contents in the converted image. This vulnerability affects all versions before 0.6.3 and requires no authentication or user interaction.
Technical details
This is an arbitrary code injection vulnerability (CWE-94, CWE-74) in the SVG parsing and conversion logic. The root cause is insufficient sanitization of SVG element attributes before processing. An attacker can bypass initial protections (which removed the "onload" attribute) by injecting event handler attributes like "onfocus" combined with "autofocus" on SVG elements, triggering JavaScript execution via eval() with base64-encoded payloads. The attack vector is network-based with no prerequisites—an application using convert-svg-core to process untrusted SVG input is immediately exploitable. An attacker can achieve arbitrary code execution in the Node.js process, including reading arbitrary files from the filesystem and embedding their contents in the output image. The vulnerability was patched in version 0.6.3 by implementing a strict allowlist of permitted SVG attributes, removing all others before conversion, with an option to disable deprecated attributes entirely.
Affected products
- neocotic convert-svg-core <0.6.3
Timeline
- 2022-06-03: disclosed
- 2022-06-06: patched
- 2022-06-10: advisory
- 2022-06-11: other: GHSA advisory published