GitHub Advisoryadvisory · npm

GHSA-j977-g5vj-j27g Cross-Site Scripting in scratch-svg-renderer

HIGH Published 2020-11-09 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-7750
Ecosystem
npm
Packages
scratch-svg-renderer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2020-11-09

Affected packages

• npm scratch-svg-renderer: < 0.2.0-prerelease.20201019174008 → fixed in 0.2.0-prerelease.20201019174008

Description

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

Related

Alias · CVE (1)

  • CVE-2020-7750 This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References