DRUPAL-CONTRIB-2020-005 - SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included i

Severity: info · Published 2020-03-04

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Svg Formatter. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Executive brief

SVG Formatter module provides support for using SVG images on your website.

This security release fixes third-party dependencies included in or required by SVG Formatter. [XSS bypass using entities and tab](https://github.com/darylldoyle/svg-sanitizer/issues/31).

This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files.

Affected products

packagist:https://packages.drupal.org/8 drupal/svg_formatter

Related threats

DRUPAL-CONTRIB-2022-028 - SVG Formatter module provides support for using SVG images on your website. Our dependency library enshrined/svg-sanitize has a cross-site
DRUPAL-CONTRIB-2018-027 - This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently hand