search

fontello / svg2ttf

SVG -> TTF font convertor
MIT License
518 stars 79 forks source link

Security issue: Misinterpretation of malicious XML input #116

Closed mzabuawala closed 3 years ago

mzabuawala commented 3 years ago

svg2ttf@6 does use xmldom ~0.6.0 which contains security issue, Please update the update to xmldom >= 0.7.0.

https://nvd.nist.gov/vuln/detail/CVE-2021-32796

xmldom
puzrin commented 3 years ago
  1. This is NOT a real problem.
  2. https://github.com/xmldom/xmldom/issues/271 0.7 is not available in npm.