CVE-2023-27586

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.

• CWE-20
• CWE-918
• CWE-918

• https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255Patch
• https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53Patch
• https://github.com/Kozea/CairoSVG/releases/tag/2.7.0Release Notes
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gvVendor Advisory
• https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255Patch
• https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53Patch
• https://github.com/Kozea/CairoSVG/releases/tag/2.7.0Release Notes
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gvVendor Advisory

Published

Mar 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27580CodeIgniter Shield provides authentication and authorization…5.9
• CVE-2023-27581github-slug-action is a GitHub Action to expose slug value o…8.8
• CVE-2023-27582maddy is a composable, all-in-one mail server. Starting with…9.8
• CVE-2023-27583PanIndex is a network disk directory index. In Panindex prio…9.8
• CVE-2023-27584Dragonfly is an open source P2P-based file distribution and …9.8
• CVE-2023-27585PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2023-27587ReadtoMyShoe, a web app that lets users upload articles and …6.5
• CVE-2023-27588Hasura is an open-source product that provides users GraphQL…7.5
• CVE-2023-27589Minio is a Multi-Cloud Object Storage framework. Starting wi…6.5
• CVE-2023-2759A hidden API exists in TapHome's core platform before versio…8.8
• CVE-2023-27590Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2023-27591Miniflux is a feed reader. Prior to version 2.0.43, an unaut…7.5