~ / search / GHSA-v2mw-5mch-w8c5

GHSA-v2mw-5mch-w8c5

canvg Prototype Pollution vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-25977

Packages

EcosystemPackageAffectedFixed in
npm canvg >= 4.0.0, < 4.0.3 4.0.3
npm canvg < 3.0.11 3.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.

References

External links from the advisory. They lead to third-party sites.