GHSA-8xqr-4cpm-wx7g
Cross-Site Scripting in react-svg
GHSA-8xqr-4cpm-wx7g is a vulnerability with no CVSS score yet in react-svg, published May 31, 2019. No source lists public exploit code. Fixed in react-svg 2.2.18.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.18react-svg
Description
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.
Recommendation
Update to version 2.2.18 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-svgnpm | before 2.2.18 | 2.2.18 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in react-svg
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.
Recommendation
Update to version 2.2.18 or later.
- Record
GHSA-8xqr-4cpm-wx7g- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in react-svg
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.
Recommendation
Update to version 2.2.18 or later.
- Record
GHSA-8xqr-4cpm-wx7g- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.