XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

2020-01-0817:15:37

Google

osv.dev

0.001 Low

EPSS

Percentile

31.1%

JSON

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

CPENameOperatorVersion
enshrined/svg-sanitizeeq0.5.2
enshrined/svg-sanitizeeq0.1.0
enshrined/svg-sanitizeeq0.1.2
enshrined/svg-sanitizeeq0.5.3
enshrined/svg-sanitizeeq0.7.0
enshrined/svg-sanitizeeq0.1.5
enshrined/svg-sanitizeeq0.5.3.1
enshrined/svg-sanitizeeq0.10.0
enshrined/svg-sanitizeeq0.1.3
enshrined/svg-sanitizeeq0.2.0

Name	Operator	Version
enshrined/svg-sanitize	eq	0.5.2
enshrined/svg-sanitize	eq	0.1.0
enshrined/svg-sanitize	eq	0.1.2
enshrined/svg-sanitize	eq	0.5.3
enshrined/svg-sanitize	eq	0.7.0
enshrined/svg-sanitize	eq	0.1.5
enshrined/svg-sanitize	eq	0.5.3.1
enshrined/svg-sanitize	eq	0.10.0
enshrined/svg-sanitize	eq	0.1.3
enshrined/svg-sanitize	eq	0.2.0