llk/scratch-svg-renderer · Security
Cross-site Scripting in Scratch-Svg-Renderer
- GHSA ID
- GHSA-h3vq-wv8j-36gw
- CVE ID
- CVE-2020-27428
- Severity
- medium
- Published
- Updated
Description
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')