DRUPAL-CONTRIB-2022-028
SVG Formatter module provides support for using SVG images on your website.
Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images.
What each source reports
OSV No score
SVG Formatter module provides support for using SVG images on your website.
Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images.
- Record
DRUPAL-CONTRIB-2022-028- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/svg_formatterPackagist:https://packages.drupal.org/8 |
before 1.17.0, 2.0.0 to 2.0.0 | 1.17.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-028 is a vulnerability with no CVSS score yet in drupal/svg_formatter, published March 9, 2022. No source lists public exploit code. Fixed in drupal/svg_formatter 1.17.0.