GHSA-8rc5-hx3v-2jg7

ghsaUSosv

Sanitizer bypass in svg-sanitizer

view advisory published 2020-02-27Licence: CC-BY-4.0

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10772US	medium6.1	0.74% (55th)	—	2019-12-11
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.

references

External citations — patches, advisories, analysis.

https://github.com/darylldoyle/svg-sanitizer/commit/6add43e5c5649bc40e3afcb68c522720dcb336f9WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10772ADVISORY
https://snyk.io/vuln/SNYK-PHP-ENSHRINEDSVGSANITIZE-536969WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan