CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Summary
canvg Prototype Pollution vulnerability
Original description
The description as published by the source.
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
canvg
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.11"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-25977 znuny
- Ubuntu UBUNTU-CVE-2025-25977 otrs2
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- report github.com
- web github.com
- web github.com