GHSA-q546-85r6-f39q: svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using svg-sanitizer versions before 1.1.0 that accept attacker-controlled SVG uploads are exposed, particularly where those SVGs may later be viewed by Safari users.
What must an attacker do to trigger exploitation?
An attacker must upload a crafted SVG containing a javascript: URL in an animateTransform values attribute and target the href attribute. The Safari user must click the resulting link for JavaScript to execute.
Is user interaction required?
Yes. The affected Safari user must click the link in the crafted SVG.
What version resolves the vulnerability?
Upgrade svg-sanitizer to version 1.1.0 or later. The issue affects versions before 1.1.0.