GHSA-45QG-252V-3F7P Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...

NPM: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

NPM: Jodit has cross-site scripting XSS via nested in SVG that bypasses clean-html sanitization vulnerability discovered by ? in WordPress Npm jodit versions 4.13.6...

CVE-2021-32245

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that wil...