What is GHSA-8xqr-4cpm-wx7g?

GHSA-8xqr-4cpm-wx7g is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in react-svg

Why does GHSA-8xqr-4cpm-wx7g have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-8xqr-4cpm-wx7g?

GHSA-8xqr-4cpm-wx7g affects 1 product, including: npm/react-svg:\u003c 2.2.18.

GHSA-8xqr-4cpm-wx7gHighDisclosed before NVD

Cross-Site Scripting in react-svg

Vendor

GitHub Security Advisories

Published

May 31, 2019

Last Modified

January 9, 2023

📋 Description

Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.

Recommendation

Update to version 2.2.18 or later.

🎯 Affected products1

npm/react-svg:< 2.2.18

🔗 References (4)

https://github.com/tanem/react-svg/pull/57
https://github.com/tanem/react-svg/pull/57/commits/ec7de5d678f53a085cee1348cb1aa069c9fc42fb
https://www.npmjs.com/advisories/648
https://github.com/advisories/GHSA-8xqr-4cpm-wx7g