Описание
Sanitizer bypass in svg-sanitizer
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
Пакеты
Наименование
enshrined/svg-sanitize
composer
Затронутые версииВерсия исправления
< 0.13.1
0.13.1
Связанные уязвимости
CVSS3: 6.1
nvd
около 6 лет назад
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.