CVE-2023-22461

Published January 4th, 2023

View on NVD ↗

CVSS v3

7.6

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds

mattkrick/sanitize-svg

a small script to prevent stored XSS attacks and detect script tags in SVGs

GitHub