Threats affecting pkg:pypi/cairosvg

CVE-2026-107378 is a high-severity vulnerability in Kozea CairoSVG versions prior to 2.9.1 caused by inefficient algorithmic complexity in SVG path rendering. The vulnerability arises from two independent O(n²) operations in the path parser and marker handling code, leading to excessive CPU usage when rendering SVGs with many path segments. An attacker can exploit this by submitting a crafted SVG with a large number of path segments, causing denial of service due to high CPU consumption during rendering.

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.