CVE-2019-10772
CVE-2019-10772
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
CVSS 6.1 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
enshrined/svg-sanitize
- Versions
- All versions prior to version 0.13.1: Affected
No fix published
enshrined/svg-sanitize Packagist
- Versions
- 0.1.0
- 0.1.1
- 0.1.2
- 0.1.3
- 0.1.4
- 0.1.5
- 0.1.6
- 0.10.0
- 0.11.0
- 0.12.0
- 0.13.0
- 0.2.0
- 0.2.1
- 0.3.0
- 0.4.0
- 0.4.1
- 0.5.0
- 0.5.1
- 0.5.2
- 0.5.3
- 0.5.3.1
- 0.6.0
- 0.7.0
- 0.7.1
- 0.7.2
- 0.8.0
- 0.8.1
- 0.8.2
- 0.9.0
- 0.9.1
- 0.9.2
- Affected ranges
- ECOSYSTEM: < 0.13.1
Update to 0.13.1