CVE-2021-23631: Convert-Svg-Core Project Convert-Svg-Core

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.

Affected products

• Convert-Svg-Core Project Convert-Svg-Core: any version

Published 2022-01-21. Last modified 2026-06-17.