# CVE-2022-24429: convert-svg-core arbitrary code injection via SVG

Source: https://junglewise.ai/threats/cve-2022-24429-convert-svg-core-arbitrary-code-injection-via-svg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-06-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-24429 · Severity: low · CVSS 3.1 · Published 2022-06-11

convert-svg-core is a Node.js library that converts SVG files into other image formats (PNG, JPEG, WebP) using headless Chromium. A specially crafted SVG file can be exploited to execute arbitrary code, allowing an attacker to read sensitive files from the system and display their contents in the converted image. This vulnerability affects all versions before 0.6.3 and requires no authentication or user interaction.

Technologies: [convert-svg-core (npm)](https://junglewise.ai/threats/technologies/convert-svg-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-24429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-24429 being exploited in the wild.

**How severe is CVE-2022-24429?** Low severity, with a CVSS score of 3.1, published 11 June 2022.

**Which products and versions are affected?** convert-svg-core (npm) SEMVER:introduced=0,fixed=0.6.3.

**Is there a fix for CVE-2022-24429?** Yes. convert-svg-core (npm): upgrade to 0.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-24429 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-24429?** Check whether you run convert-svg-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- convert-svg-core (npm): upgrade to 0.6.3 or later

  ```sh
  npm install convert-svg-core@0.6.3
  ```


## Technical details

This is an arbitrary code injection vulnerability (CWE-94, CWE-74) in the SVG parsing and conversion logic. The root cause is insufficient sanitization of SVG element attributes before processing. An attacker can bypass initial protections (which removed the "onload" attribute) by injecting event handler attributes like "onfocus" combined with "autofocus" on SVG elements, triggering JavaScript execution via eval() with base64-encoded payloads. The attack vector is network-based with no prerequisites—an application using convert-svg-core to process untrusted SVG input is immediately exploitable. An attacker can achieve arbitrary code execution in the Node.js process, including reading arbitrary files from the filesystem and embedding their contents in the output image. The vulnerability was patched in version 0.6.3 by implementing a strict allowlist of permitted SVG attributes, removing all others before conversion, with an option to disable deprecated attributes entirely.

## Affected products

- neocotic convert-svg-core <0.6.3

## Identifiers

- CVE-2022-24429
- GHSA-54px-mhwv-5v8x

## Timeline

- 2022-06-03: disclosed
- 2022-06-06: patched
- 2022-06-10: advisory
- 2022-06-11: other: GHSA advisory published

## References

- [https://github.com/neocotic/convert-svg/issues/84](https://github.com/neocotic/convert-svg/issues/84)
- [https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1](https://github.com/neocotic/convert-svg/commit/a43dffaab0f1e419d5be84e2e7356b86ffac3cf1)
- [https://github.com/neocotic/convert-svg](https://github.com/neocotic/convert-svg)
- [https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212](https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859212)

## Related threats

- [convert-svg-core remote code injection via SVG onload](https://junglewise.ai/threats/cve-2022-25759-convert-svg-core-remote-code-injection-via-svg-onload)
- [convert-svg-core directory traversal in SVG tag parsing](https://junglewise.ai/threats/cve-2022-24278-convert-svg-core-directory-traversal-in-svg-tag-parsing)
- [convert-svg path traversal via crafted SVG file](https://junglewise.ai/threats/cve-2021-23631-convert-svg-path-traversal-via-crafted-svg-file)