cargo package report

Is kuva safe?

1 known vulnerability.

// reach

0 direct dependencies

none carry a known advisory

    0 packages depend on it

    an advisory here reaches each of them

      Create a free accountfor every dependency path, dependent and what to upgrade
      // ai model usage

      Tracked for PyPI packages. HuggingFace models declare Python dependencies, so cargo packages are not covered.

      cvss
      not scored

      severity out of 10

      epss
      not scored

      chance of exploitation in 30 days

      xyz score
      not scored

      CyberXYZ composite out of 10

      fig. 01 — GHSA-3c48-9r95-hqhr, the advisory selected below

      // 1 advisories

      GHSA-3c48-9r95-hqhr

      UNKNOWN

      Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places.

      1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity was enabled via Layout::withinteractive, group and category labels were formatted directly into data-group and data-x attributes through the raw Primitive::GroupStart.extraattrs string, which the SVG backend emitted verbatim. The backend's escaping helper covered text nodes and but not attributes. A label containing a double quote could close the attribute and add another, for example an event handler. Opening the resulting SVG in a browser, or inlining it into an HTML page, executed the injected script. Reachable from scatter, line, bar, and strip plots, and from legends.

      2. Unvalidated CSS and style attribute values (CWE-74). Color::Css wrote arbitrary strings into fill and stroke, stroke-dasharray was emitted raw from the public dash-pattern builders, and the SVG root font-family and fill plus the background rectangle fill were written raw from layout and theme configuration. Applications that forwarded user-supplied style values into the plotting API could have those values break out of the attribute they were written into.

      3. Terminal escape sequence injection (CWE-150). TerminalBackend stored label characters unfiltered and emitted each one unconditionally when producing its ANSI string. Control characters in a label, including ESC, OSC sequences, and carriage returns, were written straight to the operator's terminal. Depending on the emulator this allows forged or misleading output, window title and clipboard manipulation, and reaching terminal emulator vulnerabilities that are triggered by escape sequences.

      The fix routes every data-derived string through format-appropriate escaping. A single escapeattr helper XML-escapes &, , ", and ', and is applied at each raw-attribute site: the extraattrs interpolations, the Color::Css catch-all, and the SVG backend's stroke-dasharray, font-family, and background fill writes. TerminalBackend::setchar replaces control characters with U+FFFD before they enter the character grid, so one cell stays one column rather than the grid shifting, and the ANSI writer emits the grid unchanged.

      Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked.

      Users who cannot upgrade should sanitize labels before passing them to kuva, and avoid interactive SVG output for untrusted data.

      Note that Scene::defs, Scene::scripts, and Primitive::GroupStart.extraattrs remain raw escape hatches by design. They are documented as trusted-only and are not covered by this advisory; populating them from user data is equivalent to executing that data.

      Checked 2026-10-15 at 03:54 UTC. The most recent advisory here was published 2026-08-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.

      Think a verdict here is wrong? Tell us — we respond within 2 business days.