canvg Prototype Pollution vulnerability
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-25977US | — | — | ||
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/canvg/canvgPACKAGE
- https://github.com/canvg/canvg/blob/937668eced93e0335c67a255d0d2277ea708b2cb/src/Document/StyleElement.tsWEB
- https://github.com/canvg/canvg/commit/c3743e6345f3e01aefdcdd412c3f26494f4b5d7dWEB
- https://github.com/canvg/canvg/issues/1749WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-25977ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan