CVE-2025-25977
Canvg ≤ 3.0.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-25977 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Canvg. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-25977 is a critical vulnerability in canvg version 4.0.2, a JavaScript library for rendering SVG images to HTML5 Canvas elements. The flaw, classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, or prototype pollution), resides in the constructor of the StyleElement class and enables attackers to execute arbitrary code. It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and lack of prerequisites for exploitation.
Any remote attacker can exploit this vulnerability without authentication or user interaction by supplying a maliciously crafted SVG file to an application or web page that processes SVGs using the affected canvg library. Successful exploitation leads to arbitrary code execution within the victim's browser or Node.js environment, potentially resulting in complete compromise, including data theft, further malware deployment, or full system takeover depending on the context.
Mitigation details and further discussion are available in the GitHub issue tracker at https://github.com/canvg/canvg/issues/1749, where the vulnerability was reported. Security practitioners should audit dependencies for canvg 4.0.2 and consider upgrading to patched versions if available or implementing input validation for SVG processing.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6266
Vulnerability Data
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.