CVE-2025-25977

CVE-2025-25977 is a critical vulnerability in canvg version 4.0.2, a JavaScript library for rendering SVG images to HTML5 Canvas elements. The flaw, classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, or prototype pollution), resides in the constructor of the StyleElement class and enables attackers to execute arbitrary code. It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and lack of prerequisites for exploitation.

Any remote attacker can exploit this vulnerability without authentication or user interaction by supplying a maliciously crafted SVG file to an application or web page that processes SVGs using the affected canvg library. Successful exploitation leads to arbitrary code execution within the victim's browser or Node.js environment, potentially resulting in complete compromise, including data theft, further malware deployment, or full system takeover depending on the context.

Mitigation details and further discussion are available in the GitHub issue tracker at https://github.com/canvg/canvg/issues/1749, where the vulnerability was reported. Security practitioners should audit dependencies for canvg 4.0.2 and consider upgrading to patched versions if available or implementing input validation for SVG processing.