| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free