Sanitizer bypass in svg-sanitizer

2020-02-2720:36:29

Google

osv.dev

0.001 Low

EPSS

Percentile

41.4%

JSON

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the “xlink:href” attribute due to mishandling of the xlink namespace by the sanitizer.

CPENameOperatorVersion
enshrined/svg-sanitizeeq0.5.2
enshrined/svg-sanitizeeq0.1.0
enshrined/svg-sanitizeeq0.1.2
enshrined/svg-sanitizeeq0.5.3
enshrined/svg-sanitizeeq0.7.0
enshrined/svg-sanitizeeq0.1.5
enshrined/svg-sanitizeeq0.5.3.1
enshrined/svg-sanitizeeq0.10.0
enshrined/svg-sanitizeeq0.1.3
enshrined/svg-sanitizeeq0.2.0

Name	Operator	Version
enshrined/svg-sanitize	eq	0.5.2
enshrined/svg-sanitize	eq	0.1.0
enshrined/svg-sanitize	eq	0.1.2
enshrined/svg-sanitize	eq	0.5.3
enshrined/svg-sanitize	eq	0.7.0
enshrined/svg-sanitize	eq	0.1.5
enshrined/svg-sanitize	eq	0.5.3.1
enshrined/svg-sanitize	eq	0.10.0
enshrined/svg-sanitize	eq	0.1.3
enshrined/svg-sanitize	eq	0.2.0