Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0yZ2htLXI3NWotcGp4Ms4AA3VQ
Cross-site Scripting in DOMSanitizer
DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.
Permalink: https://github.com/advisories/GHSA-2ghm-r75j-pjx2JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZ2htLXI3NWotcGp4Ms4AA3VQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 5 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-2ghm-r75j-pjx2, CVE-2023-49146
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-49146
- https://github.com/rhukster/dom-sanitizer/commit/c2a98f27ad742668b254282ccc5581871d0fb601
- https://github.com/rhukster/dom-sanitizer/compare/1.0.6...1.0.7
- https://github.com/advisories/GHSA-2ghm-r75j-pjx2
Blast Radius: 10.2
Affected Packages
packagist:rhukster/dom-sanitizer
Dependent packages: 3Dependent repositories: 47
Downloads: 430,431 total
Affected Version Ranges: < 1.0.7
Fixed in: 1.0.7
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6
All unaffected versions: 1.0.7