scratch-paint (>=0.2.0-prerelease.20180531225024, <=0.2.0-prerelease.20180607153112), scratch-render (>=0.1.0-prerelease.20180531210700, <=0.1.0-prerelease.20180605145739) potentially affected by CVE-2020-27428 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316, <=0.1.0-prerelease.20180605140533)

scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =0.2.0-prerelease.20180531225024, =0.1.0-prerelease.20180531210700, =0.1.0-prerelease.20180605145739 Source cves: CVE-2020-27428 Source advisory: OSV:GHSA-H3VQ-WV8J-36GW...

CVE-2020-27428

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...

CVE-2020-27428

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...

CVE-2020-27428

CVE-2020-27428 affects the Scratch-Svg-Renderer library (v0.2.0). The vulnerability is described as a DOM-based cross-site scripting (XSS) issue that allows an attacker to execute arbitrary web scripts or HTML through a crafted sb3 file. The cited impact indicates possible code execution in the c...

CVE-2020-27428

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...