- Latest release
- 2.9.1 (Sep 7, 2026): no advisory affects it
- Newest unaffected release
- 2.9.1 (Sep 7, 2026), the latest release
- Advisories
- 4 · 1 critical, 2 high, 1 medium
- Weekly downloads
- 4.3M
- Dependents
- 616
- Releases
- 67 since 0.1.0 (Dec 13, 2011)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-107378Affects 0.1.0 to 2.9.0 (2.9.1 is outside it)
- CVE-2026-31899Affects 0.1.0 to 2.8.2 (2.9.0 is outside it)
- CVE-2023-27586Affects 0.1.0 to 2.6.0 (2.7.0 is outside it)
- CVE-2021-21236Affects 0.1.0 to 2.5.0 (2.5.1 is outside it)
Advisories 4
- CVE-2026-107378High 8.7
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Affected: fixed in 2.9.1.
Fixed in 2.9.1 (released Sep 7, 2026, 31 days before disclosure).
The latest release, 2.9.1, is not affected.
- CVE-2026-31899High 7.5
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
Affected: fixed in 2.9.0.
Fixed in 2.9.0 (released Mar 14, 2026, 1 day after disclosure).
The latest release, 2.9.1, is not affected.
- CVE-2023-27586Critical 9.9
CairoSVG improperly processes SVG files loaded from external resources
Affected: fixed in 2.7.0.
Fixed in 2.7.0 (released Mar 20, 2023, the day of disclosure).
The latest release, 2.9.1, is not affected.
- CVE-2021-21236Medium 5.7
Regular Expression Denial of Service in CairoSVG
Affected: fixed in 2.5.1; fixed in 2.5.1.
Fixed in 2.5.1 (released Jan 6, 2021, the day of disclosure).
The latest release, 2.9.1, is not affected.