Threats affecting pkg:brew/ocrmypdf

fpdf2 contains a vulnerability where nested SVG <use> references cause exponential growth in memory and CPU usage during PDF image processing. This leads to resource exhaustion and potential denial of service when untrusted SVG input is processed by the FPDF.image() function. The issue was confirmed with a small crafted SVG causing a MemoryError after about 14 seconds under constrained memory. The vulnerability affects ocrmypdf versions from 17.0.0 up to but not including 17.11.0 and is fixed in 17.11.0.

The vulnerability in ocrmypdf arises from the fpdf2 library's behavior of implicitly loading external URLs and local image paths when rendering attacker-controlled content. This can lead to outbound HTTP(S) requests or local file access attempts if untrusted HTML, SVG, or image paths are rendered without proper sanitization. The issue affects versions from 17.0.0 up to but not including 17.11.0. The severity is medium with a CVSS score of 5.8. A fix is available in version 17.11.0.