What is GHSA-v2mw-5mch-w8c5?

GHSA-v2mw-5mch-w8c5 is a security advisory published by GitHub Security Advisories with High severity. canvg Prototype Pollution vulnerability

Which CVE IDs does GHSA-v2mw-5mch-w8c5 cover?

GHSA-v2mw-5mch-w8c5 covers the following CVE IDs: CVE-2025-25977. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-v2mw-5mch-w8c5?

GHSA-v2mw-5mch-w8c5 affects 2 products, including: npm/canvg:\u003e= 4.0.0, \u003c 4.0.3; npm/canvg:\u003c 3.0.11.

GHSA-v2mw-5mch-w8c5High

canvg Prototype Pollution vulnerability

Vendor

GitHub Security Advisories

Published

March 10, 2025

Last Modified

March 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-25977 →

📋 Description

An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.

🎯 Affected products2

npm/canvg:>= 4.0.0, < 4.0.3
npm/canvg:< 3.0.11

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-25977
https://github.com/canvg/canvg/issues/1749
https://github.com/canvg/canvg/blob/937668eced93e0335c67a255d0d2277ea708b2cb/src/Document/StyleElement.ts
https://github.com/canvg/canvg/commit/c3743e6345f3e01aefdcdd412c3f26494f4b5d7d
https://github.com/advisories/GHSA-v2mw-5mch-w8c5