svg-sanitizer SVG sanitizing library, four flaws
Picture-file checking tools can freeze or let bad scripts through.
Summary
svg-sanitizer has four flaws: crafted SVG files can hold server CPU for hours, remote URL filters can be bypassed, and scripts can run in Safari. Versions before 1.1.0 are affected, so programs that embed this library are at risk.
What to do
Update to version 1.1.0.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen