p PatchFirst

GHSA-cf4q-4cqr-7g7w

GHSA-cf4q-4cqr-7g7w · SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

This page contains facts from public vulnerability sources. Check the original advisory before updating.

xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks. Sample XML snippet: ``` <artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E"> </artwork> ``` ### Impact This vulnerability impacts website that publish HTML drafts and RFCs. ### Patches This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4). ### Workarounds If SVG source is self-contained within the XML, scraping `script` elements from SVG files. ### References * https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script ### For more information If you have any questions or comments about this advisory: * Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/) * Email us at [[email protected]](mailto:[email protected]) * [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)

Fix available

Published
Updated

Stack: python

Affected products and versions

  • xml2rfc PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.11.0
    • 2.11.1
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.12.3
    • 2.13.0
    • 2.13.1
    • 2.14.0
    • 2.14.1
    • 2.15.0
    • 2.15.1
    • 2.15.2
    • 2.15.3
    • 2.15.4
    • 2.15.5
    • 2.16.0
    • 2.16.1
    • 2.16.2
    • 2.16.3
    • 2.17.0
    • 2.17.1
    • 2.17.2
    • 2.18.0
    • 2.19.0
    • 2.19.1
    • 2.2.5
    • 2.2.7
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.21.1
    • 2.22.0
    • 2.22.1
    • 2.22.2
    • 2.22.3
    • 2.23.0
    • 2.23.1
    • 2.24.0
    • 2.25.0
    • 2.26.0
    • 2.27.0
    • 2.27.1
    • 2.28.0
    • 2.29.0
    • 2.29.1
    • 2.3.0
    • 2.3.1
    • 2.3.10
    • 2.3.11
    • 2.3.11.1
    • 2.3.11.2
    • 2.3.11.3
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.3.9
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.33.0
    • 2.34.0
    • 2.35.0
    • 2.36.0
    • 2.37.0
    • 2.37.1
    • 2.37.2
    • 2.37.3
    • 2.38.0
    • 2.38.1
    • 2.39.0
    • 2.4.0
    • 2.4.1
    • 2.4.10
    • 2.4.10.dev0
    • 2.4.11
    • 2.4.12
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.4.5
    • 2.4.6
    • 2.4.7
    • 2.4.8
    • 2.4.9
    • 2.40.0
    • 2.40.1
    • 2.41.0
    • 2.42.0
    • 2.43.0
    • 2.44.0
    • 2.45.0
    • 2.45.1
    • 2.45.2
    • 2.45.3
    • 2.46.0
    • 2.47.0
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3.dev0
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.7.0
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.8.5
    • 2.9.0
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    • 2.9.7
    • 2.9.8
    • 2.9.9
    • 3.0.0
    • 3.1.0
    • 3.1.1
    • 3.10.0
    • 3.11.0
    • 3.11.1
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.12.3
    • 3.2.0
    • 3.2.1
    • 3.3.0
    • 3.4.0
    • 3.5.0
    • 3.6.0
    • 3.7.0
    • 3.8.0
    • 3.9.0
    • 3.9.1
    Affected ranges
    • ECOSYSTEM: < 3.12.4

    Update to 3.12.4

Original sources

Check your server →