Executive brief
canvg is a popular JavaScript library that converts SVG to canvas format. A prototype pollution vulnerability in the StyleElement constructor allows attackers to modify the global JavaScript prototype chain. If the library is used in an application that passes untrusted SVG data, an attacker could inject malicious properties that affect application behavior or enable further attacks.
Technical details
The vulnerability is a prototype pollution flaw in the StyleElement constructor of canvg prior to versions 4.0.3 and 3.0.11. The flaw exists in how the library processes CSS input from SVG style elements, failing to properly sanitize property names before assigning them to objects. An attacker can craft malicious SVG containing CSS with __proto__ definitions that pollute the global Object prototype. This is triggered whenever the StyleElement constructor processes untrusted SVG input, requiring no authentication or user interaction. While the direct impact is limited, prototype pollution can enable secondary attacks if the application uses affected prototypes with sensitive operations. Patches are available in canvg 4.0.3 and 3.0.11.
Affected products
- canvg canvg all versions prior to 3.0.11 and 4.0.0-4.0.2
Timeline
- 2025-01-26: disclosed: Issue reported on GitHub
- 2025-03-10: advisory: GHSA-v2mw-5mch-w8c5 and CVE-2025-25977 published
- 2025-03-10: patched: Fix available in canvg 4.0.3 and 3.0.11