Description
The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal <script>-tags and on-event handlers were detected:
There are more ways to embed JavaScript in XML files.
Recommendation
Update the @mattkrick/sanitize-svg package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.3.1
- Patched version(s): 0.4.0
References
Could your website be exposed too?
SmartScanner can check your website for @mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor - CVE-2023-37905
- external-svg-loader Cross-site Scripting vulnerability - CVE-2023-40013
- TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes - CVE-2023-48219
- editor.md vulnerable to Cross-site Scripting - CVE-2023-29641
You might also like:
See something that needs correcting? Let us knowUpdated January 29, 2023