https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:18:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221712 EUVD-2026-221712 https://cve.radiocsirt.org/vuln/euvd-2026-221712 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22461 <p>The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `&lt;script&gt;`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds</p> <p>The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `&lt;script&gt;`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-22461 https://cve.radiocsirt.org/vuln/ghsa-h857-2g56-468g <p><strong>Affected:</strong> npm: @mattkrick/sanitize-svg</p> <p>### Impact The *sanitize-svg* package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal `&lt;script&gt;`-tags and on-event handlers were detected: ```typescript [...] const svgEl = div.firstElementChild! const attributes = Array.from(svgEl.attributes).map(({ name }) =&gt; name) const hasScriptAttr = !!attributes.find((attr) =&gt; attr.startsWith(&#39;on&#39;)) const scripts = svgEl.getElementsByTagName(&#39;script&#39;) return scripts.length === 0 &amp;&amp; !hasScriptAttr ? svg : null [...] ```</p> <p>There are more ways to embed JavaScript in XML files.</p> <p>**Anchor Tag** (requires user to click link): ```xml &lt;svg viewBox=&#34;0 0 100 100&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a href=&#34;javascript:alert(document.domain)&#34;&gt; &lt;text x=&#34;50&#34; y=&#34;50&#34; text-anchor=&#34;middle&#34;&gt;Lauritz&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>**Foreign Object Tag** (no user interaction required): ```xml &lt;svg width=&#34;500&#34; height=&#34;500&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34; xmlns:xlink=&#34;http://www.w3.org/1999/xlink&#34;&gt; &lt;text x=&#34;20&#34; y=&#34;35&#34;&gt;Lauritz&lt;/text&gt; &lt;foreignObject width=&#34;500&#34; height=&#34;500&#34;&gt; &lt;iframe xmlns=&#34;http://www.w3.org/1999/xhtml&#34; src=&#34;javascript:confirm(document.domain);&#34; width=&#34;400&#34; height=&#34;250&#34;/&gt; &lt;/foreignObject&gt; &lt;/svg&gt; ```</p> <p>As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to XSS. We are aware of at least one downstream project for which this vulnerability had security implications.</p> <p>### Patch…</p> <p><strong>Affected:</strong> npm: @mattkrick/sanitize-svg</p> <p>### Impact The *sanitize-svg* package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal `&lt;script&gt;`-tags and on-event handlers were detected: ```typescript [...] const svgEl = div.firstElementChild! const attributes = Array.from(svgEl.attributes).map(({ name }) =&gt; name) const hasScriptAttr = !!attributes.find((attr) =&gt; attr.startsWith(&#39;on&#39;)) const scripts = svgEl.getElementsByTagName(&#39;script&#39;) return scripts.length === 0 &amp;&amp; !hasScriptAttr ? svg : null [...] ```</p> <p>There are more ways to embed JavaScript in XML files.</p> <p>**Anchor Tag** (requires user to click link): ```xml &lt;svg viewBox=&#34;0 0 100 100&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt; &lt;a href=&#34;javascript:alert(document.domain)&#34;&gt; &lt;text x=&#34;50&#34; y=&#34;50&#34; text-anchor=&#34;middle&#34;&gt;Lauritz&lt;/text&gt; &lt;/a&gt; &lt;/svg&gt; ```</p> <p>**Foreign Object Tag** (no user interaction required): ```xml &lt;svg width=&#34;500&#34; height=&#34;500&#34; xmlns=&#34;http://www.w3.org/2000/svg&#34; xmlns:xlink=&#34;http://www.w3.org/1999/xlink&#34;&gt; &lt;text x=&#34;20&#34; y=&#34;35&#34;&gt;Lauritz&lt;/text&gt; &lt;foreignObject width=&#34;500&#34; height=&#34;500&#34;&gt; &lt;iframe xmlns=&#34;http://www.w3.org/1999/xhtml&#34; src=&#34;javascript:confirm(document.domain);&#34; width=&#34;400&#34; height=&#34;250&#34;/&gt; &lt;/foreignObject&gt; &lt;/svg&gt; ```</p> <p>As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to XSS. We are aware of at least one downstream project for which this vulnerability had security implications.</p> <p>### Patch…</p> https://cve.radiocsirt.org/vuln/ghsa-h857-2g56-468g https://cve.radiocsirt.org/vuln/gsd-2023-22461 gsd-2023-22461 https://cve.radiocsirt.org/vuln/gsd-2023-22461