Inkscape

11 CVEs across 1 Inkscape products. Browse Inkscape vulnerabilities, severities, and proof-of-concept exploits.

Inkscape products with known CVEs

ProductCVEs
Inkscape11
Inkscape CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-4980Medium6.32026-03-27A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafte…
CVE-2025-155232026-01-22MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main a…
CVE-2021-42704High7.82022-05-18Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.
CVE-2021-42702Low3.32022-05-18Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.
CVE-2021-42700Low3.32022-05-18Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.
CVE-2012-60762013-03-12Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users t…
CVE-2012-5656Medium5.52013-01-18The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity…
CVE-2007-14642007-03-21Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via uns…
CVE-2007-14632007-03-21Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, wh…
CVE-2005-38852005-11-29The ps2epsi extension shell script (ps2epsi.sh) in Inkscape before 0.41 allows local users to overwrite arbitrary files via a symlink attack on the tmpepsifile…
CVE-2005-37372005-11-22Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a SVG file with long…