XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-18857 · ADVISORY
• darylldoyle/svg-sanitizer commit 51ca4b7 · WEB
• darylldoyle/svg-sanitizer · PACKAGE
• darylldoyle/svg-sanitizer · WEB

Lỗ hổng khác của enshrined/svg-sanitize

• CVE-2026-107381TRUNG BÌNH 6.5svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG …
• CVE-2026-107380TRUNG BÌNH 5.4savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expa…
• CVE-2026-107379TRUNG BÌNH 6.5savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cl…
• CVE-2025-55166TRUNG BÌNH 5.1savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for l…
• CVE-2022-23638TRUNG BÌNH 6.1svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library p…