Removing Scripts Is Not Enough: Two SVG Library Flaws Highlight Deeper Risks

·1 views

Two recently disclosed vulnerabilities in SVG processing libraries reveal that stripping scripts from an SVG file does not guarantee safe processing. A use-after-free bug in librsvg (CVE-2026-96889), patched on September 23 2026 in versions 2.63.2 and 2.62.4, can be triggered through nested XML entity declarations without any JavaScript. A separate flaw in NanoSVG (CVE-2026-88366) shows that extreme arc radius values can produce undefined behavior and a potential denial of service, again requiring no scripting. Both vulnerabilities arise inside the parsing and rendering layer, meaning a sanitizer applied before these components cannot protect them from malicious input. Security experts recommend a layered approach covering explicit sanitization policies, dependency patching, resource limits, and isolated execution environments for any pipeline handling untrusted SVG files.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

git-bug Shows How Git Refs Can Store Arbitrary Data Without a Database

The open-source tool git-bug, which recently trended on Hacker News, stores bug-tracking data entirely inside a Git repository using custom refs, requiring no external server or database. Each issue is represented as a ref under refs/bugs/, with every change — such as comments or label updates — recorded as a new JSON-based commit linked to its predecessor. This approach leverages Git's built-in content-addressable object store, replication, and deduplication capabilities, effectively turning it into a lightweight event-log database. Developers can apply the same technique to store CI metadata, review notes, audit logs, or deploy configs tied to specific commits using standard Git plumbing commands. The method also supports optimistic locking via git update-ref's compare-and-swap parameter, and data can be synced to remotes by explicitly declaring custom refspecs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP OAuth 2.1: Why Discovery, PKCE, and Audience Binding Are Non-Negotiable

A technical deep-dive published on DEV Community outlines the critical security gaps in most Model Context Protocol (MCP) OAuth 2.1 implementations. The guide explains that MCP servers must serve protected resource metadata at a well-known endpoint so clients can dynamically discover the correct authorization server, rather than relying on hardcoded configurations. PKCE is mandatory for MCP clients such as CLI tools and desktop apps, which cannot securely store client secrets, and a resource parameter must be included in authorization requests to bind tokens to a specific server audience. Token validation must cover four checks — signature, audience claim, expiry, and scope — since skipping any one of them can enable cross-server token replay or unauthorized access in multi-tenant deployments. The article argues that implementations skipping these steps may appear functional in demos but introduce serious data-leak risks in production environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes App Slowness Traced to Redis Queue Blocking, Not Infrastructure

A developer deploying a voting app on AWS EKS via Terraform and Kubernetes noticed intermittent response times ranging from under a second to 60 seconds, despite all pods showing healthy. Initial suspects like AWS Classic ELB warm-up and DNS propagation were ruled out using curl's timing breakdown, which showed TCP connections completing in under 40ms every time. Further testing across three pod replicas revealed the same pod could respond instantly or take nearly a minute, eliminating the theory of a single faulty pod or node. Since all voting pods shared one Redis instance, Redis was inspected next, showing sub-millisecond average command latency. However, the investigation pointed toward Redis's single-threaded command queue as a potential bottleneck, where bursts of commands could cause delays even when individual commands were fast.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer discovers broken payment page after user report surfaces via his own email tool

A developer behind the email tool Premail learned his payment page was returning a 404 error only after a user took the time to submit a comment about it. Despite having automated tests, alerts, and infrastructure monitoring in place, none of the systems caught the broken checkout flow. The issue came to light through Premail's own morning digest feature, which surfaced the user's comment notification and prompted the developer to investigate. He acknowledged the gap in his monitoring, noting that a failed payment can easily be mistaken for a customer simply choosing not to buy. As a gesture of gratitude, he offered the reporting user a 50 percent discount and used the incident to highlight the importance of testing real user-facing flows, not just internal signals.

0 comments Read more at DEV Community