{"action":"Upgrade cairosvg to 2.9.1 or later.","affected":[{"fixed":"2.9.1","introduced":"0"}],"component":"cairosvg","cve_ids":["CVE-2026-107378"],"ecosystem":"PyPI","epss":0.00383,"exploited":false,"fixed_versions":["2.9.1"],"ghsa_id":"GHSA-c3jg-qh8m-j3h2","id":"tcs_01M5KHAJXJMS67SKNAHG97CN8Q","modified_at":"2026-10-15T14:45:05.910064482Z","published_at":"2026-10-15T10:22:52.774841Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4204","https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2","https://nvd.nist.gov/vuln/detail/CVE-2026-107378","https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523","https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565","https://github.com/Kozea/CairoSVG","https://github.com/Kozea/CairoSVG/releases/tag/2.9.1","https://pypi.org/project/cairosvg","https://github.com/advisories/GHSA-c3jg-qh8m-j3h2"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-4204","url":"https://osv.dev/vulnerability/PYSEC-2026-4204"},{"source":"nvd","source_id":"CVE-2026-107378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107378"}],"summary":"CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>"}