Description

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.

Remediation

References

https://github.com/domenic/svg2png/issues/117

Related Vulnerabilities

CVE-2020-28248 Vulnerability in npm package png-img

CVE-2020-7773 Vulnerability in npm package markdown-it-highlightjs

CVE-2021-23490 Vulnerability in npm package parse-link-header

CVE-2021-23509 Vulnerability in npm package json-ptr

CVE-2019-14653 Vulnerability in npm package editor.md

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory