-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| convert-svg-core | npm | < 0.6.2 | 0.6.2 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized SVG input processing in Converter.js. The pre-patch code used cheerio.load() to parse SVG but didn't remove dangerous event handlers like 'onload'. The attack payload demonstrates that malicious code in SVG's onload attribute would execute during conversion. The fix introduced a _sanitize method to explicitly remove 'onload' attributes, confirming this was the vulnerable code path. The _convert method is directly responsible for processing and passing unsanitized SVG content to Chromium, making it the clear vulnerable function.
Ongoing coverage of React2Shell