CVE-2020-7750: Cross-site Scripting (XSS)

Published Oct 21, 2020
·
Updated

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function.

Affected Software

86 affected components
MIT Scratch-svg-renderer Node.js=0.1.0
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease1515799461
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease1515800444
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180117145116
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180117210827
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180118201049
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180118201241
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180118224509
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180124043252
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180124054052
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180210005926
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180329174139
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180423193917
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180508170432
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180510171850
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180510181711
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180511144653
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180514170126
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180521194642
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180524204036
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180524210316
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180531205843
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180531214630
MIT Scratch-svg-renderer Node.js=0.1.0-prerelease20180605140533
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180605154326
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180607141644
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180613184320
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180618172917
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180711180400
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180712223402
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180817005452
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180821210632
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180907141232
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20180926143036
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181017193458
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181024192149
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181101210634
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181126212715
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181212190400
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181212222326
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181212230607
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181213165142
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181213192400
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181218153528
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20181220183040
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190109201344
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190110205335
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190125192231
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190304180800
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190329052730
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190419183947
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190521170426
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190523193400
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190715144718
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190715153806
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190820171249
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190822193232
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20190822202608
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20191031221353
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20191104164753
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20191217211338
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200103191258
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200103211543
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200109070519
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200205003215
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200205003400
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200507183648
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200604203226
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200609210443
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20200610220938
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201008203328
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201009194722
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201009195807
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201009202925
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201009211507
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201011114003
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201012151417
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201013123302
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201013184332
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201014105708
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201014130133
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201014145347
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201015122106
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201015135047
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201015194358
MIT Scratch-svg-renderer Node.js=0.2.0-prerelease20201016121710

Remediation

Patch Available

https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90

Event History

Oct 21, 2020
CVE Published
via MITRE·04:20 PM
Data Sourced
via MITRE·04:20 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the risk associated with CVE-2020-7750?

CVE-2020-7750 allows for arbitrary element injection into the DOM, which can lead to Cross-Site Scripting (XSS) attacks.

2

How can I mitigate the vulnerability CVE-2020-7750?

To fix CVE-2020-7750, update the scratch-svg-renderer package to version 0.2.0-prerelease.20201019174008 or later.

3

Which versions of scratch-svg-renderer are affected by CVE-2020-7750?

CVE-2020-7750 affects all versions of scratch-svg-renderer prior to 0.2.0-prerelease.20201019174008.

4

What functions are involved in the CVE-2020-7750 vulnerability?

The loadString function in scratch-svg-renderer is not escaping SVG properly, leading to vulnerability.

5

Is CVE-2020-7750 a serious vulnerability?

Yes, CVE-2020-7750 is considered serious due to the potential for XSS attacks, compromising application security.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203