{"action":"Upgrade svglib to 0.9.4 or later.","affected":[{"fixed":"0.9.4","introduced":"0"}],"component":"svglib","cve_ids":["CVE-2020-10799"],"ecosystem":"PyPI","epss":0.01528,"exploited":false,"fixed_versions":["0.9.4"],"ghsa_id":"GHSA-3vcg-8p79-jpcv","id":"tcs_01M5KG9BN7HQF2MD8DF47A7SQE","modified_at":"2023-11-08T04:02:01.152612Z","published_at":"2020-03-20T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-111","https://github.com/deeplook/svglib/issues/229","https://github.com/advisories/GHSA-3vcg-8p79-jpcv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-111","url":"https://osv.dev/vulnerability/PYSEC-2020-111"}],"summary":"The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call."}