| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| payload | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.
You are affected if:
The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí