Code injection

2020-10-2117:15:00

PRIOn knowledge base

www.prio-n.com

9.2 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.3%

JSON

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

CPENameOperatorVersion
scratch-svg-renderereq0.1.0
scratch-svg-renderereq0.1.0 prerelease1515799461
scratch-svg-renderereq0.1.0 prerelease1515800444
scratch-svg-renderereq0.1.0 prerelease20180117145116
scratch-svg-renderereq0.1.0 prerelease20180117210827
scratch-svg-renderereq0.1.0 prerelease20180118201049
scratch-svg-renderereq0.1.0 prerelease20180118201241
scratch-svg-renderereq0.1.0 prerelease20180118224509
scratch-svg-renderereq0.1.0 prerelease20180124043252
scratch-svg-renderereq0.1.0 prerelease20180124054052

Name	Operator	Version
scratch-svg-renderer	eq	0.1.0
scratch-svg-renderer	eq	0.1.0 prerelease1515799461
scratch-svg-renderer	eq	0.1.0 prerelease1515800444
scratch-svg-renderer	eq	0.1.0 prerelease20180117145116
scratch-svg-renderer	eq	0.1.0 prerelease20180117210827
scratch-svg-renderer	eq	0.1.0 prerelease20180118201049
scratch-svg-renderer	eq	0.1.0 prerelease20180118201241
scratch-svg-renderer	eq	0.1.0 prerelease20180118224509
scratch-svg-renderer	eq	0.1.0 prerelease20180124043252
scratch-svg-renderer	eq	0.1.0 prerelease20180124054052