Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

deeplook/svglib

              main @ 28a2513
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Argument Injection: 1 prior fix. Scrutinize any change in this area.

src/svglib/fonts.py: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Insecure default configuration of the XML parser allowed external entity resolution during SVG parsing, potentially leading to local file disclosure or server-side request forgery (SSRF) when processing untrusted SVG documents. This risk is tracked under CVE-2020-10799.

Argument Injection: Untrusted font names passed to subprocess calls without proper argument boundaries allowed attackers to inject flags into the 'fc-match' command, potentially leading to arbitrary code or command execution.