Vulnerabilidades de Inkscape
CVEs publicadas que afetam produtos de Inkscape: 2 registro(s), com severidade, exploração e correções.
CVE-2026-4980
Média · 6.3
CWE-611 27/03/2026
Improper Restriction of XML External Entity Reference in Inkscape
A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.
CVE-2025-15523
Média · 4.8
CWE-276 22/01/2026
TCC Bypass via Inherited Permissions in Bundled Interpreter in Inkscape.app
MacOS version of Inkscape bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions
granted by the user to the main application bundle. An attacker with local user access can
invoke this interpreter with arbitrary commands or scripts, leveraging the
application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Inkscape, potentially disguising attacker's malicious intent.
This issue has been fixed in 1.4.3 version of Inkscape.