GHSA-j977-g5vj-j27gHighCVSS 9.6

Cross-Site Scripting in scratch-svg-renderer

Published
November 9, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-7750 →

📋 Description

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

🎯 Affected products1

  • npm/scratch-svg-renderer:<= 0.2.0-prerelease.20201016121710

🔗 References (4)