GHSA-j977-g5vj-j27g
Cross-Site Scripting in scratch-svg-renderer
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | scratch-svg-renderer | < 0.2.0-prerelease.20201019174008 | 0.2.0-prerelease.20201019174008 |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
References
External links from the advisory. They lead to third-party sites.