CVE-2022-23638

svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.

Score

CVSS 3.1 6.2 Medium

Status

Modified - security-advisories@github.com

Published

2022-02-14

Last modified

2025-04-23

Weaknesses

CWE-79

Affected products

• Svg-sanitizer (Darylldoyle)
• Svg-sanitizer (Svg-sanitizer Project)

References

• https://github.com/darylldoyle/svg-sanitizer/commit/17e12ba9c2881caa6b167d0fbea555c11207fbb0
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-fqx8-v33p-4qcc