GitHub Advisoryadvisory · PyPI

GHSA-cf4q-4cqr-7g7w SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

MEDIUM Published 2022-04-22 Modified 2022-04-22 Official page ↗
Ecosystem
PyPI
Packages
xml2rfc
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-04-22

Affected packages

• PyPI xml2rfc: < 3.12.4 → fixed in 3.12.4

Description

xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks. Sample XML snippet: ``` ``` Impact This vulnerability impacts website that publish HTML drafts and RFCs. Patches This has been fixed in version 3.12.4. Workarounds If SVG source is self-contained within the XML, scraping `script` elements from SVG files. References • https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script For more information If you have any questions or comments about this advisory: • Open an issue in xml2rfc • Email us at [email protected] • Infrastructure and Services Vulnerability Disclosure

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References