CairoSVG vulnerabilities

3 known vulnerabilities in CairoSVG from Kozea. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  CairoSVG: Inefficient Algorithmic Complexity

  CVE-2026-107378Oct 8, 2026Kozea

  CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and resc

• 7.5 High severity

  CairoSVG: Uncontrolled Recursion

  CVE-2026-31899Mar 13, 2026Kozea

  CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

• 7.1 High severity

  CairoSVG: Server-Side Request Forgery

  CVE-2023-27586Mar 20, 2023Kozea

  CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side