Executive brief
react-svg is a React component library used to embed and render SVG files in web applications. Versions before 2.2.18 execute JavaScript code found within SVG files by default, allowing attackers to inject malicious scripts. An attacker who controls an SVG file loaded by the application can execute arbitrary JavaScript in users' browsers, potentially stealing session data, modifying page content, or performing actions on behalf of users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the react-svg library caused by a configuration mismatch: the documentation stated that the evalScripts property defaults to "never" (disabling script execution), but the code actually defaulted to "once" (executing scripts). When SVG files are loaded, any embedded scripts are executed in the browser context of the application. An attacker can exploit this by providing a malicious SVG file containing embedded JavaScript, which will execute without user interaction when the component renders the SVG. The fix (PR #57, merged April 2018) corrects the default value to "never" as documented, disabling script execution by default. The patched version 2.2.18 or later resolves this issue.
Affected products
- npm react-svg before 2.2.18
Timeline
- 2019-05-31: disclosed
- 2018-04-21: patched: Patch merged in PR #57; fix version 2.2.18 released