GitHub Advisoryadvisory · Packagist

GHSA-gf8j-v8x5-h9qp XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

HIGH Published 2020-01-08 Modified 2022-02-16 Official page ↗
Aliases
CVE-2019-18857
Ecosystem
Packagist
Packages
enshrined/svg-sanitize
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-01-08

Affected packages

• Packagist enshrined/svg-sanitize: < 0.12.0 → fixed in 0.12.0

Description

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.

Related

Alias · CVE (1)

  • CVE-2019-18857 darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References