HIGH7.5

GHSA-gf8j-v8x5-h9qp

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

Quick fix

GHSA-gf8j-v8x5-h9qp — enshrined/svg-sanitize: upgrade to the fixed version with the command below.

composer require enshrined/svg-sanitize:^0.12.0

Details

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/enshrined/svg-sanitize

Introduced in: 0Fixed in: 0.12.0

Fixcomposer require enshrined/svg-sanitize:^0.12.0

References

https://nvd.nist.gov/vuln/detail/CVE-2019-18857[ADVISORY]
https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0[WEB]
https://github.com/darylldoyle/svg-sanitizer[PACKAGE]
https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0[WEB]