~ / search / GHSA-4p8j-vhjm-6pvw

GHSA-4p8j-vhjm-6pvw

TCPDF lacks SVG sanitization

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-56519

Packages

EcosystemPackageAffectedFixed in
Packagist tecnickcom/tcpdf < 6.8.0 6.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.

References

External links from the advisory. They lead to third-party sites.