# CVE-2026-107378: CairoSVG quadratic-time DoS parsing crafted SVG path

Source: https://junglewise.ai/threats/cve-2026-107378-cairosvg-quadratic-time-dos-parsing-a-crafted-svg-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107378 · Severity: high · CVSS 4 · Published 2026-10-08

CairoSVG is a library that converts SVG graphics to PNG, PDF, and other formats. An attacker can cause a denial of service by uploading a malicious SVG file with a large number of path segments, which triggers quadratic-time parsing that consumes tens of seconds of CPU on a sub-megabyte document. This impacts any service that renders user-supplied SVG files such as thumbnail generators, avatar processors, or PDF exporters.

Technologies: [CairoSVG (PyPI)](https://junglewise.ai/threats/technologies/cairosvg). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107378 being exploited in the wild.

**How severe is CVE-2026-107378?** High severity, with a CVSS score of 4, published 8 October 2026.

**Which products and versions are affected?** CairoSVG before 2.9.1; CairoSVG (PyPI) <= 2.9.0, ECOSYSTEM:introduced=0,fixed=2.9.1.

**Is there a fix for CVE-2026-107378?** Yes. CairoSVG (PyPI): upgrade to 2.9.1 or later. Until then: Validate and reject SVG files with excessively large path segments, or limit the number of segments per path element before rendering. Restrict SVG rendering to trusted sources where feasible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107378 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107378?** Check whether you run CairoSVG or CairoSVG (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- CairoSVG (PyPI): upgrade to 2.9.1 or later

  ```sh
  pip install "CairoSVG>=2.9.1"
  ```


Validate and reject SVG files with excessively large path segments, or limit the number of segments per path element before rendering. Restrict SVG rendering to trusted sources where feasible.

## Technical details

The vulnerability stems from two separate O(n²) algorithmic flaws in cairosvg/path.py: a tokenizer that repeatedly re-scans the remaining path-data string via slicing, and a draw_markers function that drains a vertices list using list.pop(0), which is O(n) per operation. Both code paths are hit during normal SVG rendering on attacker-controlled input, allowing a sub-1 MiB crafted SVG to consume 18+ seconds of CPU.

## Affected products

- CairoSVG CairoSVG before 2.9.1

## Identifiers

- CVE-2026-107378
- GHSA-c3jg-qh8m-j3h2
- PYSEC-2026-4204

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Kozea CairoSVG exponential denial of service in defs.py](https://junglewise.ai/threats/cve-2026-31899-kozea-cairosvg-exponential-denial-of-service-in-defs-py)
- [CairoSVG improperly processes SVG files loaded from external resources](https://junglewise.ai/threats/cve-2023-27586-cairosvg-improperly-processes-svg-files-loaded-from-external)
- [Regular Expression Denial of Service in CairoSVG](https://junglewise.ai/threats/cve-2021-21236-regular-expression-denial-of-service-in-cairosvg)