@maggioli-design-system/mds-icon (2.0.0-rc.1), esto-es-una-prueba-ui-components (1.0.0) potentially affected by CVE-2023-40013 via external-svg-loader (>=1.4.0, <=1.6.8)

external-svg-loader NPM version =1.4.0, =1.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on external-svg-loader and may be impacted: - @maggioli-design-system/mds-icon 2.0.0-rc.1 - esto-es-una-prueba-ui-components 1.0.0 Source cves: CVE-2023-40013...

CVE-2023-40013

SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivial...

CVE-2023-40013

CVE-2023-40013 affects the external-svg-loader / SVG Loader JS library. The vulnerability arises from insufficient input sanitization when injecting fetched SVGs, allowing crafted SVGs to bypass sanitization and trigger Cross-site Scripting (XSS). Affected behavior: external sites that accept use...