What’s Vulnerable › Vulnerabilities

CVE-2023-27586: CairoSVG improperly processes SVG files loaded from external resources

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-20 · updated 2026-06-17
• Weakness: CWE-20

Description

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

Affected products

• Kozea CairoSVG: before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Kozea CairoSVG 2.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255
• https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53
• https://github.com/Kozea/CairoSVG/releases/tag/2.7.0
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv
• https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255
• https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53
• https://github.com/Kozea/CairoSVG/releases/tag/2.7.0
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv

Get alerted when CVE-2023-27586 or the next vulnerability affects your stack