N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xpg8-7m6m-jf56

GHSA-xpg8-7m6m-jf56: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

An attacker can inject arbitrary MVG (Magick Vector Graphics) drawing commands in an SVG file that is read by the internal SVG decoder of ImageMagick. The injected MVG commands execute during rendering.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xpg8-7m6m-jf56

GHSA-xpg8-7m6m-jf56:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Magick.NET-Q16-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-HDRI-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-OpenMP-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q16-x86	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-AnyCPU	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-OpenMP-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-arm64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x64	nuget	< 14.10.3	14.10.3
Magick.NET-Q8-x86	nuget	< 14.10.3	14.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection flaw within the ImageMagick's internal SVG decoder. The root cause is the failure to properly sanitize and escape user-controllable data from an SVG file before constructing Magick Vector Graphics (MVG) commands. An attacker can embed malicious MVG syntax within various parts of an SVG file, such as element attributes (e.g., href), style properties, or descriptive text.

The analysis of the patches reveals that several functions in coders/svg.c were involved in processing this untrusted data. The primary vulnerable functions are SVGStartElement, SVGProcessStyleElement, and SVGEndElement. These functions were responsible for parsing the SVG structure and directly using values from the file to generate the output MVG file. The patches systematically add escaping to mitigate this, primarily by introducing a new SVGEscapeString function and applying it to all incoming values from attributes and styles. The changes in SVGEndElement show how unescaped data, like URLs, were previously being written directly into the MVG command stream. During the rendering of the malicious SVG, these injected commands would be executed by the MVG engine, leading to the vulnerability.

Vulnerable functions

SVGStartElement

coders/svg.c

This function parses attributes from SVG elements. Before the patch, it directly used attribute values from the SVG file without sanitization. An attacker could provide a crafted attribute value (e.g., in an 'href') containing malicious MVG commands, which would then be processed and executed during rendering.

SVGProcessStyleElement

coders/svg.c

This function processes CSS style information within an SVG file. It was vulnerable because it would take values from style properties and use them to generate MVG output without escaping. This allowed an attacker to inject MVG commands via style properties.

SVGEndElement

coders/svg.c

This function is responsible for generating MVG commands when an SVG element is closed. It was vulnerable because it would use unescaped data, such as the URL from an 'image' or 'use' element, and write it directly into the output MVG stream. This allowed an attacker to inject arbitrary commands by crafting a malicious URL or other element content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.