Threats affecting pkg:github/inkscape/inkscape

CVE-2026-4980 is a local file disclosure vulnerability in Inkscape versions 1.1 up to but not including 1.3. It arises from improper restriction of XML External Entity (XXE) references in the XInclude processing component. An attacker can craft an SVG file with malicious xi:include tags to read local files when the file is opened. The vulnerability has a medium severity with a CVSS score of 6.3. It was fixed in Inkscape version 1.3.