Sanitize Svg
Approved changes feed: RSS · Atom
cpe:2.3:a:sanitize-svg_project:sanitize-svg:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Sanitize Svg Project (6be5a8c1-6845-55dd-9955-1365f050a67d) |
|---|---|
| Product | Sanitize Svg (b6e97754-618a-59d8-81a2-0c51e507bdde) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-22461 |
vulnerable | 2026-06-08 05:54:26.351026 |
sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)
HIGH (7.6)
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds
Published: 2023-01-04T14:57:04.902Z
Updated: 2025-03-10T21:33:03.572Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.