CVSS 3.1
9.6 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE-2020-7750
Critical (9.6) in mit scratch-svg-renderer. EPSS 6.1% chance of exploitation in the next 30 days. Fixed in scratch-svg-renderer 0.2.0-prerelease.20201019174008.
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Severity
- EPSS
- 6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mit:scratch-svg-renderer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j977-g5vj-j27g | npm | scratch-svg-renderer | <0.2.0-prerelease.20201019174008 | 0.2.0-prerelease.20201019174008 |