CairoSVG 2.9.1 Fixes High-Severity Denial-of-Service Vulnerability in SVG Rendering

Kozea has released version 2.9.1 of CairoSVG to address a high-severity denial-of-service vulnerability that allows attackers to consume excessive CPU resources through specially crafted SVG files. The flaw, tracked as CVE-2026-107378, affects all versions of the library prior to 2.9.1.

The vulnerability stems from inefficient code within the `cairosvg/path.py` module, which processes SVG path data. According to the GitHub advisory GHSA-c3jg-qh8m-j3h2, two independent operations in the library exhibit quadratic time complexity, or O(n²), when handling paths with many segments. The first issue occurs in the path tokenizer, which repeatedly slices and rescans the remaining string data in a loop. The second issue arises in the `draw_markers` function, which removes items from the start of a list using `list.pop(0)`, an operation that becomes increasingly slow as the list lengthens.

Technical Context

An attacker can exploit this weakness by supplying an SVG document containing a single `<path>` element with a large number of segments. The source material indicates that an SVG file smaller than one megabyte can cause substantial CPU consumption, effectively denying service to the application rendering the file. Testing described in the advisory shows that doubling the number of path segments approximately quadruples the processing time. For example, a 488 KB file with 100,000 segments took 4.36 seconds to process, while a nearly 1 MB file with 200,000 segments took approximately 18 seconds.

The vulnerability is reachable through standard public APIs, including `svg2png`, `svg2pdf`, and `svg2ps`. Because these functions are commonly used for generating thumbnails, avatars, or PDF exports from user-supplied content, any service that renders untrusted SVGs is a potential target for denial-of-service attacks. The National Vulnerability Database lists the weakness under CWE-407.

Affected Systems

The vulnerability impacts the `cairosvg` package available via pip. Versions 2.9.0 and earlier are vulnerable. The fix is included in version 2.9.1. The advisory notes that the suggested fix involves changing the tokenization logic to use a single forward scan or index instead of re-slicing the remainder of the string. Additionally, the marker handling code should be updated to use an index or `collections.deque.popleft` instead of `list.pop(0)` to avoid linear-time removal operations. Optionally, developers may cap the path-segment count to further mitigate resource exhaustion.

What should you do?

Users of CairoSVG should update to version 2.9.1 immediately if they have not already done so. Organizations that render user-supplied SVG files should verify their current library version. If updating is not immediately possible, consider restricting the size or complexity of accepted SVG files to limit the impact of potential attacks. Monitor vendor channels for any further updates or advisories related to this component.