CVE-2022-23638 Cross-site Scripting in svg-sanitizer
An attacker can inject malicious scripts via SVG files processed by the svg-sanitizer library, potentially executing code in the victim's browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23638?
CVE-2022-23638 is a medium-severity cross-site scripting vulnerability in darylldoyle svg-sanitizer, published on 14 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
Weakness: CWE-79
Which versions are affected by CVE-2022-23638?
2 open source packages ship an affected version, including enshrined/svg-sanitize. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
enshrined/svg-sanitize Packagist | All versions | 0.15.0 |
enshrined/svg-sanitize Packagist | All versions | 0.15.0 |
Products include Svg-Sanitizer Project Svg-Sanitizer.
How do I fix CVE-2022-23638?
Upgrade enshrined/svg-sanitize to 0.15.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23638 being exploited?
There is no known exploitation of CVE-2022-23638 in the wild and no public exploit code.
Other vulnerabilities in darylldoyle svg-sanitizer
Sources
Also known as GHSA-fqx8-v33p-4qcc, UBUNTU-CVE-2022-23638.