CVE-2020-7750: Cross-Site Scripting in scratch-svg-renderer
Summary
CVE-2020-7750: Cross-Site Scripting in scratch-svg-renderer. Affects scratch-svg-renderer versions < 0.2.0-prerelease.20201019174008. Fixed in 0.2.0-prerelease.20201019174008. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The scratch-svg-renderer package is an npm package used for rendering SVG images in the Scratch programming environment. It provides functionality to load and display SVG files. However, versions before 0.2.0-prerelease.20201019174008 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability allows an attacker to inject arbitrary elements into the DOM by exploiting the improper SVG escaping in the loadString function.
Vulnerability Detail
The vulnerability in scratch-svg-renderer arises from the inadequate SVG escaping in the loadString function. By crafting a malicious SVG file, an attacker can inject arbitrary elements into the DOM. This can lead to various security risks, including the execution of unauthorized code, theft of sensitive information, and manipulation of the rendered SVG content. The severity of this vulnerability is rated as HIGH with a CVSS score of 9.6.
How To Fix
Minimum fixed version
0.2.0-prerelease.20201019174008
This is the first release that contains the fix.
npm install scratch-svg-renderer@0.2.0-prerelease.20201019174008Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the SVG content before passing it to the loadString function. This can be achieved using a library like DOMPurify to sanitize the SVG string and remove any potentially malicious elements. Here's an example of how to use DOMPurify with scratch-svg-renderer:
const DOMPurify = require('dompurify');
const renderer = require('scratch-svg-renderer');
const svgString = '<svg>...</svg>'; // SVG content to be rendered
const sanitizedSvgString = DOMPurify.sanitize(svgString);
renderer.loadString(sanitizedSvgString);
Note that this is just a temporary workaround, and it is strongly recommended to update to the latest version of the package as soon as possible.
Conclusion
In conclusion, the scratch-svg-renderer package before version 0.2.0-prerelease.20201019174008 is vulnerable to a Cross-Site Scripting (XSS) attack. This can allow an attacker to inject arbitrary elements into the DOM and potentially execute unauthorized code or manipulate the rendered SVG content. It is crucial to update to the latest version of the package or apply the recommended workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scratch-svg-renderer →
FAQ
scratch-svg-renderer is an npm package used for rendering SVG images in the Scratch programming environment. It provides functionality to load and display SVG files.
This vulnerability allows an attacker to inject arbitrary elements into the DOM by exploiting the improper SVG escaping in the loadString function. This can lead to the execution of unauthorized code, theft of sensitive information, and manipulation of the rendered SVG content.
The severity of this vulnerability is rated as HIGH with a CVSS score of 9.6.
To fix this vulnerability, it is recommended to update the scratch-svg-renderer package to version 0.2.0-prerelease.20201019174008 or later. This version includes the necessary fixes to properly escape SVG content and prevent the injection of arbitrary elements into the DOM.
As a temporary workaround, developers can manually sanitize the SVG content before passing it to the loadString function. This can be achieved using a library like DOMPurify to sanitize the SVG string and remove any potentially malicious elements. However, it is strongly recommended to update to the latest version of the package as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for scratch-svg-renderer.
