Executive brief
The svg_optimizer Ruby library is used to optimize and clean SVG (Scalable Vector Graphics) files. A vulnerability in versions before 0.3.0 enabled XML entity expansion when parsing untrusted SVG documents, potentially allowing an attacker to trigger denial-of-service attacks or information disclosure by crafting malicious SVG files that exploit entity substitution.
Technical details
The vulnerability is an XML External Entity (XXE) / entity expansion issue in the svg_optimizer gem. The root cause is the improper use of Nokogiri's NOENT (entity substitution) parse option by default when parsing SVG documents. According to Nokogiri's documentation, the NOENT option is unsafe when parsing untrusted documents as it enables entity substitution. An attacker can supply a malicious SVG file containing XML entity definitions (e.g., billion laughs attack or external entity references) to applications using the library. The fix, released in version 0.3.0, disables entity expansion by default and provides a `trusted: true` keyword argument to allow entity expansion only when explicitly needed for trusted documents. No network access is required; the attack requires the application to process an attacker-supplied SVG file.
Affected products
- fnando svg_optimizer before 0.3.0
Timeline
- 2023-10-19: disclosed
- 2023-09-25: patched: Fix merged in PR #17 on Sep 25, 2023; version 0.3.0 released
- 2026-09-14: advisory: CVE-2023-46035 published