CVE-2020-7750

CRITICAL EPSS 92.5%
Published Oct 21, 20205y ago · Modified Jun 17, 20262w ago
9.6 CVSS 3.1
Critical
Find Similar
Published Oct 21, 2020 5y ago
Last Modified Jun 17, 2026 2w ago

Description

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

CVSS Details

Base Score
9.6
Exploitability
2.8
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
92.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 86

VendorProductVersionRange
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.1.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any
mitscratch-svg-renderer0.2.0any

References 2

  • github.com https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
    PatchThird Party Advisory
  • snyk.io https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497
    Third Party Advisory

Remediation

  • github.com https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
    PatchThird Party Advisory