{"action":"Upgrade cairosvg to 2.7.0 or later.","affected":[{"fixed":"2.7.0","introduced":"0"}],"component":"cairosvg","cve_ids":["CVE-2023-27586"],"ecosystem":"PyPI","epss":0.00722,"exploited":false,"fixed_versions":["2.7.0"],"ghsa_id":"GHSA-rwmf-w63j-p7gv","id":"tcs_01M5KGKT8BTJ5EXYTG2333Q5DE","modified_at":"2023-11-08T04:12:06.950413Z","published_at":"2023-03-20T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-9","https://github.com/Kozea/CairoSVG/releases/tag/2.7.0","https://github.com/Kozea/CairoSVG/security/advisories/GHSA-rwmf-w63j-p7gv","https://github.com/Kozea/CairoSVG/commit/12d31c653c0254fa9d9853f66b04ea46e7397255","https://github.com/Kozea/CairoSVG/commit/33007d4af9195e2bfb2ff9af064c4c2d8e4b2b53"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-9","url":"https://osv.dev/vulnerability/PYSEC-2023-9"}],"summary":"CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a speciall"}