{"id":"GHSA-gf8j-v8x5-h9qp","aliases":["CVE-2019-18857"],"title":"XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.","severity":"high","score":7.5,"published":"2020-01-08T17:15:37.000Z","modified":"2023-11-08T04:01:26.579Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"enshrined/svg-sanitize","sources":[{"name":"OSV · GHSA-gf8j-v8x5-h9qp","url":"https://osv.dev/vulnerability/GHSA-gf8j-v8x5-h9qp"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.12.0"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.11.0","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3.1","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2"],"fixed":["0.12.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-18857","https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0","https://github.com/darylldoyle/svg-sanitizer","https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0"],"sources":[{"name":"OSV","id":"GHSA-gf8j-v8x5-h9qp","modified":"2023-11-08T04:01:26.579900Z","url":"https://osv.dev/vulnerability/GHSA-gf8j-v8x5-h9qp"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:15:33.378Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}