What is GHSA-4p8j-vhjm-6pvw?

GHSA-4p8j-vhjm-6pvw is a security advisory published by GitHub Security Advisories with Medium severity. TCPDF lacks SVG sanitization

Which CVE IDs does GHSA-4p8j-vhjm-6pvw cover?

GHSA-4p8j-vhjm-6pvw covers the following CVE IDs: CVE-2024-56519. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4p8j-vhjm-6pvw?

GHSA-4p8j-vhjm-6pvw affects 1 product, including: composer/tecnickcom/tcpdf:\u003c 6.8.0.

GHSA-4p8j-vhjm-6pvwMedium

TCPDF lacks SVG sanitization

Vendor

GitHub Security Advisories

Published

December 27, 2024

Last Modified

November 3, 2025

🔗 CVE IDs covered (1)

CVE-2024-56519 →

📋 Description

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.

🎯 Affected products1

composer/tecnickcom/tcpdf:< 6.8.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-56519
https://github.com/tecnickcom/TCPDF/commit/c9f41cbb84880bdb4fc3e0a9d287214d1ac4d7f4
https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
https://tcpdf.org
https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html
https://github.com/advisories/GHSA-4p8j-vhjm-6pvw