p PatchFirst

CVE-2023-27586

CVE-2023-27586 · CairoSVG improperly processes SVG files loaded from external resources

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

CVSS 9.9 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cairosvg

    Versions
    • < 2.7.0: Affected

    No fix published

  • cairosvg Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.5.2-1.1

    Update to 2.5.2-1.1

  • cairosvg Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.5.2-1.1

    Update to 2.5.2-1.1

  • cairosvg Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.5.2-1.1

    Update to 2.5.2-1.1

  • cairosvg PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.1.2
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5
    • 1.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.0rc6
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.6.0
    Affected ranges
    • ECOSYSTEM: < 2.7.0

    Update to 2.7.0

  • cairosvg PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.1.2
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.5
    • 1.0
    • 1.0.1
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.0rc6
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.6.0
    Affected ranges
    • {"events": [{"introduced": "0"}, {"fixed": "12d31c653c0254fa9d9853f66b04ea46e7397255"}, {"fixed": "33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53"}], "repo": "https://github.com/Kozea/CairoSVG", "type": "GIT"}
    • ECOSYSTEM: < 2.7.0

    Update to 2.7.0

  • cairosvg Ubuntu:16.04:LTS

    Versions
    • 1.0.16-1
    • 1.0.17-1
    • 1.0.19-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:18.04:LTS

    Versions
    • 1.0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:20.04:LTS

    Versions
    • 2.4.0-2
    • 2.4.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:22.04:LTS

    Versions
    • 2.5.0-1.1
    • 2.5.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:24.04:LTS

    Versions
    • 2.7.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:25.10

    Versions
    • 2.7.1-1
    • 2.7.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:26.10

    Versions
    • 2.8.2-1
    • 2.9.0-1
    • 2.9.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cairosvg Ubuntu:26.04:LTS

    Versions
    • 2.7.1-2
    • 2.8.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →