Veracode Vulnerability DatabaseVERACODE:42812Cross-site Scripting (XSS)
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
0.001 Low
EPSS
Percentile
21.6%
external-svg-loader is vulnerable to Cross-site Scripting (XSS). The vulnerability exists due to the lack of input sanitization in the renderBody function of svg-loader.js, which allows an attacker to inject and execute malicious JavaScript through a maliciously crafted SVG.
| CPE | Name | Operator | Version |
|---|---|---|---|
| external-svg-loader | le | 1.6.8 | |
| external-svg-loader | le | 1.6.8 |
References
github.com/advisories/GHSA-xc2r-jf2x-gjr8
github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128
github.com/shubhamjain/svg-loader/commit/d3562fc08497aec5f33eb82017fa1417b3319e2c
github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8
github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript
Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
0.001 Low
EPSS
Percentile
21.6%