What is GHSA-gf8j-v8x5-h9qp?

GHSA-gf8j-v8x5-h9qp is a security advisory published by GitHub Security Advisories with High severity. XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

Which CVE IDs does GHSA-gf8j-v8x5-h9qp cover?

GHSA-gf8j-v8x5-h9qp covers the following CVE IDs: CVE-2019-18857. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gf8j-v8x5-h9qp?

GHSA-gf8j-v8x5-h9qp has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gf8j-v8x5-h9qp?

GHSA-gf8j-v8x5-h9qp affects 1 product, including: composer/enshrined/svg-sanitize:\u003c 0.12.0.

GHSA-gf8j-v8x5-h9qpHighCVSS 7.5

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

Vendor

GitHub Security Advisories

Published

January 8, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-18857 →

📋 Description

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

🎯 Affected products1

composer/enshrined/svg-sanitize:< 0.12.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-18857
https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0
https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0
https://github.com/advisories/GHSA-gf8j-v8x5-h9qp