| Package | Affected versions | Patched versions |
|---|---|---|
| enshrined/svg-sanitize | < 0.13.1 | 0.13.1 |
| svg-sanitizer | < 0.13.1 | 0.13.1 |
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free