CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary
Rendering an untrusted SVG whose <path d="..."> contains many segments is O(n²) CPU. A single <path> under 1 MiB burns tens of seconds. Two independent O(n²) sites in cairosvg/path.py:
- Tokenizer — the path-data parser consumes the
dstring with awhile string:loop that repeatedly slices/re-scans the remaining string (each step is O(len remaining)), giving O(n²) over the whole attribute. - draw_markers — marker handling drains
node.verticeswithwhile node.vertices: ... node.vertices.pop(0);list.pop(0)is O(n), so draining n vertices is O(n²).
Both are hit on a normal render path (svg2png/svg2pdf), attacker controls only the SVG document.
PoC (installed cairosvg 2.9.0)
import cairosvg
d = "M0 0 " + "L1 1 " * 100000
svg = f'<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><path d="{d}"/></svg>'
cairosvg.svg2png(bytestring=svg.encode()) # ~4.4 s for a 488 KB doc| path segments | SVG size | time |
|---|---|---|
| 50,000 | 244 KB | 1.14 s |
| 100,000 | 488 KB | 4.36 s |
| 200,000 | ~960 KB | ~18 s |
Doubling segments ≈ 4× time ⇒ quadratic. Sub-MiB input ⇒ ~18 s CPU; any service rendering user-supplied SVG (thumbnails, avatars, PDF export) is a DoS target.
Reachability
Public API svg2png / svg2pdf / svg2ps on an untrusted SVG string.
Suggested fix
Tokenize with a single forward scan / index (or re.finditer) instead of re-slicing the remainder; drain vertices with an index or collections.deque.popleft instead of list.pop(0). Optionally cap path-segment count.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | cairosvg | < 2.9.1 | 2.9.1 |
Referencias
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2
- https://nvd.nist.gov/vuln/detail/CVE-2026-107378
- https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523
- https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565
- https://github.com/Kozea/CairoSVG
- https://github.com/Kozea/CairoSVG/releases/tag/2.9.1
- https://pypi.org/project/cairosvg
- https://github.com/advisories/GHSA-c3jg-qh8m-j3h2
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-407- Plataforma
- Python (PyPI)
- Paquete
cairosvg- Publicada
- 08.10.2026
- Actualizado
- 15.10.2026 18:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-4204 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-c3jg-qh8m-j3h2 - CC BY 4.0
Historial de vulnerabilidades: cairosvg
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 01.2021 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
Divulgaciones por año
- 2021: 1
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path> esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.