View online: https://www.drupal.org/sa-contrib-2020-005

Project: SVG Formatter [1] Date: 2020-March-04 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting

Description:  SVG Formatter module provides support for using SVG images on your website.

This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab [3].

This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files.

Solution:  Install the latest version:

* If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.12 [4]

Also see the SVG Formatter [5] project page.

Reported By:  * Jeroen Tubex [6]

Fixed By:  * Goran Nikolovski [7]

Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team

[1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/darylldoyle/svg-sanitizer/issues/31 [4] https://www.drupal.org/project/svg_formatter/releases/8.x-1.12 [5] https://www.drupal.org/project/svg_formatter [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/3451979 [8] https://www.drupal.org/user/36762