Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)
Vulnerability Description
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
sanitize-svg 安全漏洞
Vulnerability Description
sanitize-svg是一个防止XSS攻击的小型SVG消毒器。 sanitize-svg 0.4.0之前的版本存在安全漏洞，该漏洞源于其使用deny-list模式来消毒svg以防止跨站脚本，但攻击者可以通过XML文件中嵌入JavaScript导致依赖其对svg进行消毒并期望得到安全的svg的下游软件可能容易受到跨站脚本。
CVSS Information
N/A
Vulnerability Type
N/A