Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-site Scripting (XSS)
Vulnerability Description
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability Type
N/A
Vulnerability Title
scratch-svg-renderer 跨站脚本漏洞
Vulnerability Description
scratch-svg-renderer是Scratch团队的一个应用于转换 SVG 成 DOM 元素的代码库。 scratch-svg-renderer 0.2.0-prerelease.20201019174008之前版本存在安全漏洞，该漏洞源于loadString函数没有正确地转义SVG，可以使用它通过transformMeasurements函数将任意元素注入到DOM中。
CVSS Information
N/A
Vulnerability Type
N/A