{"action":"Upgrade cairosvg to 2.9.1 or later.","affected":[{"fixed":"2.9.1","introduced":"0"}],"component":"cairosvg","cve_ids":["CVE-2026-107378"],"ecosystem":"PyPI","epss":0.00383,"exploited":false,"fixed_versions":["2.9.1"],"ghsa_id":"GHSA-c3jg-qh8m-j3h2","id":"tcs_01M5KFC27PQS4YTRYYAGD5M9MA","modified_at":"2026-10-15T14:56:21.119947482Z","published_at":"2026-10-08T19:41:22Z","references":["https://osv.dev/vulnerability/GHSA-c3jg-qh8m-j3h2","https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2","https://nvd.nist.gov/vuln/detail/CVE-2026-107378","https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523","https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565","https://github.com/Kozea/CairoSVG","https://github.com/Kozea/CairoSVG/releases/tag/2.9.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-c3jg-qh8m-j3h2","url":"https://osv.dev/vulnerability/GHSA-c3jg-qh8m-j3h2"},{"source":"nvd","source_id":"CVE-2026-107378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107378"}],"summary":"CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>"}