CVE-2025-25977: canvg Prototype Pollution
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2025-25977DEBIAN-CVE-2025-25977GHSA-v2mw-5mch-w8c5CGA-2399-r42r-j7p8CGA-2gmv-qpm5-x7j2CGA-2xrc-94c8-p2j9CGA-3228-qphp-r6vqCGA-35mp-h74h-c5wxCGA-37xx-hp5g-r8v8CGA-3j3h-f897-c26vCGA-3v3f-pf2p-hqgjCGA-4rgf-6894-wqh2CGA-5435-r569-m6qpCGA-564c-cp55-xff3CGA-5f2h-w66c-5hmcCGA-6h2r-55mw-2qm3CGA-7459-xhqw-qr87CGA-7g6h-v3rm-jxhmCGA-7mrp-5fpr-92r8CGA-7rp5-f8q2-w4c5CGA-7x8f-7g78-c7g2CGA-84r3-mx8f-5429CGA-875j-jj9w-rqq7CGA-8fp2-6w6h-8qv3CGA-8mrp-r5qv-f5j6CGA-8mvr-h6x7-qjmxCGA-8w64-499w-j8rqCGA-9246-f47p-c5m7CGA-c5w3-g7jw-34rxCGA-f65g-xpfc-rm2vCGA-f92x-8m2f-76h3CGA-g6x6-p6v8-gxp4CGA-g7p2-q2gj-ww6qCGA-gq75-w2rm-x4cqCGA-hp9h-qc7r-25wwCGA-hqx4-mfpq-x35vCGA-j593-7rr4-24jgCGA-jf4m-rmwg-2vhgCGA-jf8j-whw6-gxq7CGA-jp2p-77jw-mp4xCGA-jr75-2w39-wwxcCGA-mfhw-hjhj-f833CGA-mhfw-g7rp-6c5pCGA-p9pw-g6cv-gfgpCGA-ppv9-cp87-wgqwCGA-px53-9h3w-v8xxCGA-q2cg-6c5w-82f3CGA-q36r-cgrx-9hhpCGA-qff7-x5fr-vmw6CGA-qgjq-42p2-g4vwCGA-qm3h-2q55-cc2wCGA-qp4p-pgpv-53fjCGA-qvqf-h8r2-c75rCGA-qwj4-vq2r-hg8xCGA-v76j-356c-gv5wCGA-vf52-mh44-pjjqCGA-w34m-7263-9jppCGA-wfcf-ppf8-mj5xCGA-wv8f-2wq3-73q5CGA-x87q-vw95-3rxpCGA-xm2w-8x3p-3hwjCGA-xw44-vcrc-864qCGA-xwhh-hf4v-c4h9
Published 10-03-2025Last modified 12-03-2025
Vulnerability summary
CVE-2025-25977 is a critical (CVSS 9.8) Prototype Pollution vulnerability in canvg. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.71%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 10-03-2025PublishedVulnerability first disclosed.
- 12-03-2025Last modifiedVulnerability information updated.
Description
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
CVSS metrics
6 scores · 6 sources · 2 versionsCritical 9.3Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:PSourcesSingle source
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.01 pp
From 0.71% on 21-09-2026
21-09-202621-10-2026
EPSS score0.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCanvg
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard30 products
- opensearch-dashboards-2< 2.19.1-r2
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.1-r2
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.1-r2
- opensearch-dashboards-2-config< 2.19.1-r2
- opensearch-dashboards-2-dashboards-maps< 2.19.1-r2
Ubuntu2 products
- otrs2All versions (No fix recorded)
- znunyAll versions (No fix recorded)
Canvg1 product
- canvg< 3.0.11 | ≥ 4.0.0, < 4.0.3
Debian1 product
- znunyAll versions (No fix recorded) | < 6.5.24-1
Npm1 product
- canvg≥ 4.0.0, < 4.0.3 | < 3.0.11
5 vendors · 35 products
References
10 links
- github.com/canvg/canvgPACKAGE