PyPI/cairosvg CVE-2026-31899: high 7.5, EPSS 0.51%

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

Action: Upgrade cairosvg to 2.9.0 or later.

pip install cairosvg==2.9.0

Affected

Fixed versions

Sources

• osv: GHSA-f38f-5xpm-9r7c
• https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
• https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf
• https://github.com/Kozea/CairoSVG

CVE-2026-31899 · published 2026-03-13T18:57:31Z · modified 2026-07-13T07:26:50.032778438Z · JSON