Cross-Site Scripting in SVG Sanitizer Plugin by Daryll Doyle
CVE-2019-18857

7.5HIGH

Key Information:

Vendor

Svg-sanitizer Project

Status
Svg-sanitizer
Vendor
CVE Published:
11 November 2019

What is CVE-2019-18857?

The SVG Sanitizer plugin by Daryll Doyle has a vulnerability in versions prior to 0.12.0 that allows an attacker to inject malicious scripts. This occurs due to improper handling of script and data attributes, particularly when whitespace is present within typical malicious payloads. Affected users may inadvertently expose their applications to XSS attacks, enabling attackers to execute unauthorized scripts in the context of the user's browser.

References

https://github.com/darylldoyle/svg-sanitizer/commit/51ca4...
x_refsource_MISC
https://github.com/darylldoyle/svg-sanitizer/compare/0.11...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.