Description
According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in XSS.
Recommendation
Update the external-svg-loader package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.6.9
- Patched version(s): 1.6.9
References
Could your website be exposed too?
SmartScanner can check your website for external-svg-loader Cross-site Scripting vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
- @excalidraw/excalidraw Cross-site Scripting vulnerability - CVE-2023-26140
- @mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) - CVE-2023-22461
- Scrypted Cross-site Scripting vulnerability - CVE-2023-47623
You might also like:
See something that needs correcting? Let us knowUpdated November 08, 2023