The package convert-svg-core prior to 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
convert-svg-core project convert-svg-core