CVE-2019-10772

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...

CVE-2019-10772

creationtimestamp| type| source ---|---|--- 2024-03-10 12:11:40+00:00| seen| https://t.me/ctinow/204227...

CVE-2019-10772

CVE-2019-10772 affects enshrined/svg-sanitize (svg-sanitizer) before 0.13.1. The root cause is mishandling of the xlink namespace, allowing bypass of the sanitizer via the xlink:href attribute. This can enable cross-site scripting (XSS) in SVGs processed by affected software (e.g., via an anchor ...

CVE-2019-10772

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...