GHSA-gf8j-v8x5-h9qp

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

Source: GitHub Advisory Database (reviewed) High CVE-2019-18857

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	enshrined/svg-sanitize	< 0.12.0	0.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-18857 advisory
https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0 web
https://github.com/darylldoyle/svg-sanitizer package
https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0 web