svg-infographic

This utility measures SVG text using headless Chromium, but inserts the input SVG unescaped into an HTML document that is opened in the browser. A malicious SVG could execute script or trigger external resource requests during processing, making this a security risk when inputs are untrusted; no specific external domain, credential target, or deliberate data-exfiltration behavior is present in the fragment. Severity is moderate and depends on the SVG input and the browser's file-origin protections.