In short
- CVE-2020-11887 is a MEDIUM (CVSS 6.1) vulnerability affecting svg2png (svg2png project), svg2png.
- Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.4% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| svg2png | = 4.1.1
| No fix yet |
| svg2png npm | ≤ 4.1.1
| No fix yet |
Description
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
NVD description
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free