Executive brief
convert-svg-core is a Node.js library used to convert SVG images into other formats using headless Chromium. An attacker can inject malicious JavaScript code by embedding it in an SVG file's onload attribute, which Chromium will execute without validation. This allows remote code execution on any server processing untrusted SVG files, potentially enabling data theft, system compromise, or lateral movement.
Technical details
This is a code injection vulnerability (CWE-94) in convert-svg-core before version 0.6.2. The root cause is insufficient input sanitization of SVG files before passing them to Puppeteer/Chromium for rendering. An attacker can craft an SVG file with a malicious onload event handler (e.g., `<svg onload="eval(...)">`), which Chromium automatically executes when the SVG is rendered. Since the library does not strip or escape the onload attribute, arbitrary JavaScript code runs with the privileges of the Node.js process. Attack vector is network-based with no authentication or user interaction required—any application accepting untrusted SVG input and using convert-svg-core is vulnerable. The impact is complete system compromise, including arbitrary code execution, file system access, and lateral movement. The fix (merged May 29, 2022) strips the onload attribute from SVG input before processing. Upgrade to version 0.6.2 or later to resolve the issue.
Affected products
- neocotic convert-svg-core <0.6.2
Timeline
- 2022-05-26: disclosed: Vulnerability reported (Issue #81)
- 2022-05-29: other: Fix merged (PR #82, commit 7e6031a)
- 2022-06-01: patched: Fix released in version 0.6.2 (per Snyk disclosure date)
- 2022-07-23: advisory: GitHub Security Advisory GHSA-5gxc-fxcr-9326 published