Cross-site Scripting in enshrined/svg-sanitize

TRUNG BÌNH 6.1CVE-2022-23638 · GHSA-fqx8-v33p-4qcc · Công bố 14/02/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-23638 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng enshrined/svg-sanitize, svg-sanitizer (svg-sanitizer project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.68%, cao hơn 52.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.15.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
enshrined/svg-sanitize Packagist	`< 0.15.0`	`0.15.0`
svg-sanitizer svg-sanitizer_project	`< 0.15.0`	`0.15.0`

Mô tả

Impact

SVG sanitizer library before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as text/html) was susceptible to cross-site scripting. Plain SVG files (fetched as image/svg+xml) were not affected.

Patches

This issue is fixed in 0.15.0 and higher.

Workarounds

There is currently no workaround available without upgrading.

For more information

If you have any questions or comments about this advisory:

Open an issue in Github
Email us at [email protected]

Mô tả của NVD

svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.