@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)

Description

The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal <script>-tags and on-event handlers were detected:

There are more ways to embed JavaScript in XML files.

Recommendation

Update the @mattkrick/sanitize-svg package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.3.1
• Patched version(s): 0.4.0

References

• GHSA-h857-2g56-468g
• CVE-2023-22461
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor - CVE-2023-37905
• external-svg-loader Cross-site Scripting vulnerability - CVE-2023-40013
• TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes - CVE-2023-48219
• editor.md vulnerable to Cross-site Scripting - CVE-2023-29641

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@mattkrick/sanitize-svg