https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-25759.htmlhttps://patchthecve.com/cve/CVE-2022-25759.htmlWed, 17 Jun 2026 04:34:13 +0000CRITICAL 9.9: The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.https://patchthecve.com/cve/CVE-2022-24429.htmlhttps://patchthecve.com/cve/CVE-2022-24429.htmlWed, 17 Jun 2026 04:31:49 +0000HIGH 7.5: The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.https://patchthecve.com/cve/CVE-2021-23631.htmlhttps://patchthecve.com/cve/CVE-2021-23631.htmlWed, 17 Jun 2026 03:38:50 +0000HIGH 7.5: This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.