CVE-2022-24278: Convert-Svg Project Convert-Svg

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.

Affected products

• Convert-Svg Project Convert-Svg: before 0.6.4 (fixed in 0.6.4)

Published 2022-06-10. Last modified 2026-06-17.