canvg Prototype Pollution vulnerability

Description

An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.

Recommendation

Update the canvg package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.0.11

  >= 4.0.0, < 4.0.3**

• Patched version(s): **3.0.11

  4.0.3**

References

• GHSA-v2mw-5mch-w8c5
• CVE-2025-25977
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash.unset - CVE-2025-13465
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - CVE-2025-13465
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es - CVE-2025-13465
• js-toml Prototype Pollution Vulnerability - CVE-2025-54803

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

canvg