CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)
Attackers can bypass SVG sanitization to inject malicious scripts, leading to cross-site scripting in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-22461?
CVE-2023-22461 is a high-severity cross-site scripting vulnerability in mattkrick sanitize-svg, published on 4 Jan 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds
Which versions are affected by CVE-2023-22461?
2 open source packages ship an affected version, including @mattkrick/sanitize-svg. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@mattkrick/sanitize-svg npm | All versions | 0.4.0 |
@mattkrick/sanitize-svg npm | All versions | 0.4.0 |
Products include Sanitize-Svg Project Sanitize-Svg.
How do I fix CVE-2023-22461?
Upgrade @mattkrick/sanitize-svg to 0.4.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-22461 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22461 exists.
Sources
Also known as GHSA-h857-2g56-468g.