TI-2020-16667 Aliases CVE-2020-27428 GHSA-h3vq-wv8j-36gw

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0…

LOW 28CWE-79Published 2022-01-05 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.

Why it matters now

EPSS 0.00666 52nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	scratch-svg-renderer (npm)	up to 0.2.0	—	No fix listed	GHSA-h3vq-wv8j-36gw

— Vendor— Affected all versions Fixed in — No fix listed CNA
scratch-svg-renderer (npm) Vendor— Affected up to 0.2.0 Fixed in — No fix listed GHSA-h3vq-wv8j-36gw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:::::node.js::	0.2.0	Vulnerable	moos-ivp

cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:*:*:*:*:node.js:*:* Versions 0.2.0 Vulnerable ·moos-ivp

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-27428
2026-10-03 Alias added: GHSA-h3vq-wv8j-36gw
2026-10-21 EPSS moved to the 50th–90th percentile

References

TI-2020-06268 Cross-site scripting (XSS) in scratch-svg-renderer CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences