Skip to content

Updating ImageSharp Libraries to address current CVEs. #486

@IntegerMan

Description

@IntegerMan

We're getting code scan results highlighting the SixLabors.ImageSharp dependency that PdfSharpCore has:

CVE-2024-41131 (High) - requires 2.1.9+
CVE-2025-27598 (High) - requires 2.1.10+
CVE-2024-27929 (High) - requires 2.1.7+
CVE-2024-32035 (Medium) - requires 2.1.8+
CVE-2024-32036 (Medium) - requires 2.1.8+
CVE-2024-41132 (Medium) - requires 2.1.9+
CVE-2025-54575 (Medium) - requires 2.1.11+

It looks like these vulnerabilities could be addressed if PdfSharpCore releases a new version that updates the ImageSharp dependency to a newer version to avoid these issues, however, the last minor release was 8 months ago at the moment.

I'd like to see dependencies updated to 2.1.11 or higher and a new NuGet package made available.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions