@0x6368656174/wp-builder (>=1.0.8, <=1.2.1), @beezyinc/dr-svg-sprites-bz (>=0.9.33, <=1.0.4) +145 more potentially affected by CVE-2020-11887 via svg2png (>=4.0.0, <=4.1.1)

svg2png NPM version =4.0.0, =1.0.8, =0.9.33, =0.9.33, =0.0.1, =0.0.1-alpha.44, =0.0.1-alpha.117, =0.0.4, =1.0.0, =2.1.0, =0.0.2, =0.0.10, =2.0.0, =0.0.0-semantically-released, =1.0.7, =1.0.8 and more Source cves: CVE-2020-11887 Source advisory: OSV:GHSA-MPP5-2X55-49XW...

CVE-2020-11887

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document...

CVE-2020-11887

svg2png 4.1.1 contains a vulnerability that allows cross-site scripting (XSS) with resultant SSRF via JavaScript inside an SVG document. The issue is documented across multiple sources (NVD, Red Hat, Veracode, OSV, GHSA, CNVD, etc.). Affected component is the SVG rendering/processing in svg2png; ...