PT-2023-29810 · Fnando · Svg Optimizer

Published 2023-10-20 · Updated 2023-10-20 · CVE-2023-46035

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Fnando svg optimizer version 0.2.6

Description The issue allows a remote attacker to escalate privileges when optimizing untrusted SVG content.

Recommendations For Fnando svg optimizer version 0.2.6, update to a version that fixes the privilege escalation issue, as using untrusted SVG content can lead to exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-46035

GHSA-6HVG-62Q8-95V7

Affected Products

Svg Optimizer

References · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/svg_optimizer/CVE-2023-46035.yml · Exploit
• https://osv.dev/vulnerability/GHSA-6hvg-62q8-95v7 · Vendor Advisory
• https://github.com/fnando/svg_optimizer/pull/17 · Note
• https://github.com/fnando/svg_optimizer · Note
• https://github.com/fnando/svg_optimizer/commit/b1b5013db297494daba5676b9fa4423ffc5e96fa · Note
• https://github.com/fnando/svg_optimizer/commit/8244ff25b51a16892496e9d9f7191dba393f7af0 · Note