@f/is-svg
NPM
Releases1
Last Release
Check whether or not a tag name is an SVG element
CVE History
| CVE | Affected | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|---|
| >= 2.1.0, < 4.3.0 | 7.5 HIGH | 5 MEDIUM | ||
A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string. | ||||
| >= 2.1.0, <= 4.2.1, >= 2.1.0, < 4.2.2 | 7.5 HIGH | 5 MEDIUM | ||
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time. | ||||