GitHub Advisoryadvisory · Packagist

GHSA-5jgj-h9wp-53fr Known vulnerable to code execution via SVG file in v1.3.1

MEDIUM Published 2022-07-09 Modified 2022-07-19 Official page ↗
Aliases
CVE-2022-32115
Ecosystem
Packagist
Packages
idno/known
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-15

Affected packages

• Packagist idno/known: <= 1.3.1 (no fix yet)

Description

An issue in the isSVG() function of Known v1.3.1 allows attackers to execute arbitrary code via a crafted SVG file. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

Related

Alias · CVE (1)

  • CVE-2022-32115 An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References