GHSA-2p49-hgcm-8545: SVGO removeScripts plugin leaves some executable scripts intact
SVGO’s removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.
References
- github.com/advisories/GHSA-2p49-hgcm-8545
- github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466
- github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f
- github.com/svg/svgo/commit/f529cfccc6c154d6f6eabe276ec637a8c5db6763
- github.com/svg/svgo/releases/tag/v2.8.3
- github.com/svg/svgo/releases/tag/v3.3.4
- github.com/svg/svgo/releases/tag/v4.0.2
- github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545
Code Behaviors & Features
Detect and mitigate GHSA-2p49-hgcm-8545 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →