Executive brief
Scratch-Svg-Renderer is a JavaScript library used to render SVG graphics in Scratch projects. A flaw in version 0.2.0 allows attackers to inject malicious scripts by crafting a specially formatted .sb3 (Scratch) project file, which could lead to unauthorized code execution in a user's browser and compromise of user sessions or data.
Technical details
A DOM-based cross-site scripting (XSS) vulnerability exists in Scratch-Svg-Renderer v0.2.0, classified as CWE-79. The vulnerability is triggered when processing a crafted .sb3 project file that contains malicious SVG content. The library fails to properly sanitize event handlers and inline scripts in SVG elements during parsing. An attacker can create a malicious Scratch project file and distribute it, causing arbitrary JavaScript execution when the file is loaded and rendered in a user's browser. The fix was applied in commit 7c74ec7, which removes problematic event handlers from SVG processing.
Affected products
- Scratch Foundation scratch-svg-renderer 0.2.0
Timeline
- 2022-01-08: disclosed
- 2022-01-06: patched: Fix applied via commit 7c74ec7