Sanitizer bypass in svg-sanitizer

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...

CVE-2019-10772

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...

Design/Logic Flaw

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...

Sanitizer Bypass

Overview enshrined/svg-sanitize is a SVG sanitizer for PHP Affected versions of this package are vulnerable to Sanitizer Bypass. It is possible to bypass enshrined\svgSanitize\Sanitizer using the xlink:href attribute due to mishandling of the xlink namespace. PoC by Snyk Security Team XSS Details...