Read the docs

Svg-sanitizer Project

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Svg-sanitizer Project records in CISA KEV

No Svg-sanitizer Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Svg-sanitizer 3 records LOW

Records

3 records

TI-2022-07690 CVE-2022-23638 · GHSA-fqx8-v33p-4qcc

Cross-site Scripting in svg-sanitizer

Priority LOW 29

svg-sanitizer is a SVG/XML sanitizer written in PHP.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00679 Published 2022-02-14 Fixed in 0.15.0 CWE-79
TI-2019-08037 CVE-2019-10772 · GHSA-8rc5-hx3v-2jg7

Cross-site scripting in enshrined/svg-sanitize

Priority LOW 29

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00741 Published 2019-12-11 Fixed in 0.13.1 CWE-79
Open these records in search →