CVE-2019-18857
High
Description
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSvg-sanitizer
PublishedNov 11, 2019
First seenNov 11, 2019
How to fix
Update
- svg-sanitizer_project svg-sanitizer0.12.0 or later
- enshrined/svg-sanitize0.12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| svg-sanitizer_project svg-sanitizer | v < 0.12.0 | 0.12.0 |
| enshrined/svg-sanitizePackagist | v < 0.12.0 | 0.12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.