What is GHSA-cf4q-4cqr-7g7w?

GHSA-cf4q-4cqr-7g7w is a security advisory published by GitHub Security Advisories with Medium severity. SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

Why does GHSA-cf4q-4cqr-7g7w have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-cf4q-4cqr-7g7w?

GHSA-cf4q-4cqr-7g7w affects 1 product, including: pip/xml2rfc:\u003c 3.12.4.

GHSA-cf4q-4cqr-7g7wMediumDisclosed before NVD

SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

Vendor

GitHub Security Advisories

Published

April 22, 2022

Last Modified

January 11, 2023

📋 Description

xml2rfc allows script elements in SVG sources. In HTML output having these script elements can lead to XSS attacks.

Sample XML snippet:

<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>

Impact

This vulnerability impacts website that publish HTML drafts and RFCs.

Patches

This has been fixed in version 3.12.4.

Workarounds

If SVG source is self-contained within the XML, scraping script elements from SVG files.

References

https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

For more information

If you have any questions or comments about this advisory:

Open an issue in xml2rfc
Email us at [email protected]
Infrastructure and Services Vulnerability Disclosure

🎯 Affected products1

pip/xml2rfc:< 3.12.4