Is CVE-2022-25759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25759 being exploited in the wild.

How severe is CVE-2022-25759?

Low severity, with a CVSS score of 3.1, published 23 July 2022.

Which products and versions are affected?

convert-svg-core (npm) SEMVER:introduced=0,fixed=0.6.2.

Is there a fix for CVE-2022-25759?

Yes. convert-svg-core (npm): upgrade to 0.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25759 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25759?

Check whether you run convert-svg-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25759: convert-svg-core remote code injection via SVG onload

CVE-2022-25759 · Severity: low · CVSS 3.1 · Published 2022-07-23

convert-svg-core is a Node.js library used to convert SVG images into other formats using headless Chromium. An attacker can inject malicious JavaScript code by embedding it in an SVG file's onload attribute, which Chromium will execute without validation. This allows remote code execution on any server processing untrusted SVG files, potentially enabling data theft, system compromise, or lateral movement.

Technologies: convert-svg-core (npm). Vendors: npm.

Quick answers

Is CVE-2022-25759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25759 being exploited in the wild.
How severe is CVE-2022-25759?: Low severity, with a CVSS score of 3.1, published 23 July 2022.
Which products and versions are affected?: convert-svg-core (npm) SEMVER:introduced=0,fixed=0.6.2.
Is there a fix for CVE-2022-25759?: Yes. convert-svg-core (npm): upgrade to 0.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25759 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25759?: Check whether you run convert-svg-core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

convert-svg-core (npm): upgrade to 0.6.2 or later
```
npm install convert-svg-core@0.6.2
```

Technical details

This is a code injection vulnerability (CWE-94) in convert-svg-core before version 0.6.2. The root cause is insufficient input sanitization of SVG files before passing them to Puppeteer/Chromium for rendering. An attacker can craft an SVG file with a malicious onload event handler (e.g., `<svg onload="eval(...)">`), which Chromium automatically executes when the SVG is rendered. Since the library does not strip or escape the onload attribute, arbitrary JavaScript code runs with the privileges of the Node.js process. Attack vector is network-based with no authentication or user interaction required—any application accepting untrusted SVG input and using convert-svg-core is vulnerable. The impact is complete system compromise, including arbitrary code execution, file system access, and lateral movement. The fix (merged May 29, 2022) strips the onload attribute from SVG input before processing. Upgrade to version 0.6.2 or later to resolve the issue.

Affected products

neocotic convert-svg-core <0.6.2

Identifiers

CVE-2022-25759
GHSA-5gxc-fxcr-9326

Timeline

2022-05-26: disclosed: Vulnerability reported (Issue #81)
2022-05-29: other: Fix merged (PR #82, commit 7e6031a)
2022-06-01: patched: Fix released in version 0.6.2 (per Snyk disclosure date)
2022-07-23: advisory: GitHub Security Advisory GHSA-5gxc-fxcr-9326 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.