CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Summary
Rendering an untrusted SVG whose <path d="..."> contains many segments is O(n²) CPU. A single <path> under 1 MiB burns tens of seconds. Two independent O(n²) sites in cairosvg/path.py:
- Tokenizer — the path-data parser consumes the
dstring with awhile string:loop that repeatedly slices/re-scans the remaining string (each step is O(len remaining)), giving O(n²) over the whole attribute. - draw_markers — marker handling drains
node.verticeswithwhile node.vertices: ... node.vertices.pop(0);list.pop(0)is O(n), so draining n vertices is O(n²).
Both are hit on a normal render path (svg2png/svg2pdf), attacker controls only the SVG document.
PoC (installed cairosvg 2.9.0)
import cairosvg
d = "M0 0 " + "L1 1 " * 100000
svg = f'<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><path d="{d}"/></svg>'
cairosvg.svg2png(bytestring=svg.encode()) # ~4.4 s for a 488 KB doc| path segments | SVG size | time |
|---|---|---|
| 50,000 | 244 KB | 1.14 s |
| 100,000 | 488 KB | 4.36 s |
| 200,000 | ~960 KB | ~18 s |
Doubling segments ≈ 4× time ⇒ quadratic. Sub-MiB input ⇒ ~18 s CPU; any service rendering user-supplied SVG (thumbnails, avatars, PDF export) is a DoS target.
Reachability
Public API svg2png / svg2pdf / svg2ps on an untrusted SVG string.
Suggested fix
Tokenize with a single forward scan / index (or re.finditer) instead of re-slicing the remainder; drain vertices with an index or collections.deque.popleft instead of list.pop(0). Optionally cap path-segment count.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | cairosvg | < 2.9.1 | 2.9.1 |
References
- https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2
- https://nvd.nist.gov/vuln/detail/CVE-2026-107378
- https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523
- https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565
- https://github.com/Kozea/CairoSVG
- https://github.com/Kozea/CairoSVG/releases/tag/2.9.1
- https://pypi.org/project/cairosvg
- https://github.com/advisories/GHSA-c3jg-qh8m-j3h2
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-407- Platform
- Python (PyPI)
- Package
cairosvg- Disclosed
- 08.10.2026
- Updated
- 15.10.2026 18:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-4204 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-c3jg-qh8m-j3h2 - CC BY 4.0
Vulnerability history: cairosvg
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 01.2021 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path> this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.