View online: https://www.drupal.org/sa-contrib-2020-005 Project: SVG Formatter [1] Date: 2020-March-04 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting Description:  SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab [3]. This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files. Solution:  Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.12 [4] Also see the SVG Formatter [5] project page. Reported By:  * Jeroen Tubex [6] Fixed By:  * Goran Nikolovski [7] Coordinated By:  * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/darylldoyle/svg-sanitizer/issues/31 [4] https://www.drupal.org/project/svg_formatter/releases/8.x-1.12 [5] https://www.drupal.org/project/svg_formatter [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/3451979 [8] https://www.drupal.org/user/36762