Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-23631

CVE-2021-23631:
Path Traversal in convert-svg packages

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-23631
GHSA ID
GHSA-jv7g-9g6q-cxvw
EPSS Score
0.57912%
CWE
CWE-22
Published
1/27/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
convert-svg-corenpm<= 0.5.0
convert-svg-to-pngnpm<= 0.5.0
convert-svg-to-jpegnpm<= 0.5.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how SVG files are processed during conversion. The PoC demonstrates that the convert() function (used by all three packages) renders SVG content containing file:// URI schemes in iframe elements. This indicates the conversion function fails to: 1. validate()/sanitize external resource references 2. Restrict filesystem access when rendering embedded content 3. Properly sandbox the rendering environment. As all affected packages share the core conversion logic, the vulnerability likely resides in the fundamental SVG processing implementation within convert-svg-core.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*is *****ts *ll v*rsions o* p**k*** *onv*rt-sv*-*or*; *ll v*rsions o* p**k*** *onv*rt-sv*-to-pn*; *ll v*rsions o* p**k*** *onv*rt-sv*-to-jp**. Usin* * sp**i*lly *r**t** SV* *il*, *n *tt**k*r *oul* r*** *r*itr*ry *il*s *rom t** *il* syst*m *n* t**n s

Reasoning

T** vuln*r**ility st*ms *rom *ow SV* *il*s *r* pro**ss** *urin* *onv*rsion. T** Po* **monstr*t*s t**t t** `*onv*rt()` *un*tion (us** *y *ll t*r** p**k***s) r*n**rs SV* *ont*nt *ont*inin* *il*:// URI s***m*s in i*r*m* *l*m*nts. T*is in*i**t*s t** *onv