~ / search / GHSA-hg3j-6pmh-mvjr

GHSA-hg3j-6pmh-mvjr

Fiora chat user avatar is vulnerable to XSS via SVG files

Source: GitHub Advisory Database (reviewed) Low CVE-2025-56514

Packages

EcosystemPackageAffectedFixed in
npm fiora 1.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.

References

External links from the advisory. They lead to third-party sites.