FONTS ARE STILL A HELVETICA OF A PROBLEM

Summary from the TLDR Web Dev newsletter

Canva's team found security risks in popular font-handling tools. For example, they found an XML vulnerability in FontTools, where the application’s SVG font subsetting feature could be exploited to allow hackers to read arbitrary files. To prevent such issues, Canva treats fonts as untrusted inputs, sandboxes font processing, uses sanitization, and collaborates with open-source maintainers by providing security patches.