XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

ALTO 7.5CVE-2019-18857 · GHSA-gf8j-v8x5-h9qp · Published 11/11/2019 · updated 17/06/2026

Em resumo

CVE-2019-18857 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta enshrined/svg-sanitize, svg-sanitizer (svg-sanitizer project).
Chance de exploração nos próximos 30 dias (EPSS): 1.0%, maior que 64.1% das vulnerabilidades.
Correção: atualize para 0.12.0 ou posterior.

Package	Affected versions	Patched versions
enshrined/svg-sanitize Packagist	`< 0.12.0`	`0.12.0`
svg-sanitizer svg-sanitizer_project	`< 0.12.0`	`0.12.0`

Description

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

NVD description

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.

References

nvd.nist.gov/vuln/detail/CVE-2019-18857 · ADVISORY
darylldoyle/svg-sanitizer commit 51ca4b7 · WEB
darylldoyle/svg-sanitizer · PACKAGE
darylldoyle/svg-sanitizer · WEB

Mais vulnerabilidades de enshrined/svg-sanitize

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

enshrined/svg-sanitize

Packagist

< 0.12.0

0.12.0

svg-sanitizer

svg-sanitizer_project

< 0.12.0

0.12.0

Description

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

NVD description

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.

Mais vulnerabilidades de enshrined/svg-sanitize

Ver tudo →