~ / search / GHSA-2ghm-r75j-pjx2

GHSA-2ghm-r75j-pjx2

Cross-site Scripting in DOMSanitizer

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-49146

Packages

EcosystemPackageAffectedFixed in
Packagist rhukster/dom-sanitizer < 1.0.7 1.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.

References

External links from the advisory. They lead to third-party sites.