CVE-2020-7750
Cross-site Scripting (XSS)
CRITICAL 9.6EPSS 6.1%
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
- Affected
- scratch-svg-renderer
- CVSS v3.1 SNYK
- 9.6 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 6.12% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2020-10-21
- Updated
- 2024-09-16
Proof-of-concept exploits (1)
- ossf-cve-benchmark/CVE-2020-77500★ · 2020-12-08
ExploitDB entries (1)
Security advisories
- LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
- https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497
- advisories/GHSA-j977-g5vj-j27g