GHSA-cf4q-4cqr-7g7w
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
GHSA-cf4q-4cqr-7g7w is a vulnerability with no CVSS score yet in xml2rfc, published April 22, 2022. No source lists public exploit code. Fixed in xml2rfc 3.12.4.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.12.4xml2rfc +1 more
Description
xml2rfc allows script elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.
Sample XML snippet:
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>
Impact
This vulnerability impacts website that publish HTML drafts and RFCs.
Patches
This has been fixed in version 3.12.4.
Workarounds
If SVG source is self-contained within the XML, scraping script elements from SVG files.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in xml2rfc
- Email us at operational-vulnerability@ietf.org
- Infrastructure and Services Vulnerability Disclosure
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xml2rfcPyPI | before 3.12.4 | 3.12.4 |
xml2rfcPyPI | before 3.12.4, plus listed versions 2.10.02.10.12.10.22.10.32.11.0 Show 45 moreShow less2.11.12.12.02.12.12.12.22.12.32.13.02.13.12.14.02.14.12.15.02.15.12.15.22.15.32.15.42.15.52.16.02.16.12.16.22.16.32.17.02.17.12.17.22.18.02.19.02.19.12.2.52.2.72.20.02.20.12.21.02.21.12.22.02.22.12.22.22.22.32.23.02.23.12.24.02.25.02.26.02.27.02.27.12.28.02.29.02.29.1 | 3.12.4 |
What each source reports
GitHub AdvisoriesNo score
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
xml2rfc allows script elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.
Sample XML snippet:
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>
Impact
This vulnerability impacts website that publish HTML drafts and RFCs.
Patches
This has been fixed in version 3.12.4.
Workarounds
If SVG source is self-contained within the XML, scraping script elements from SVG files.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in xml2rfc
- Email us at operational-vulnerability@ietf.org
- Infrastructure and Services Vulnerability Disclosure
- Record
GHSA-cf4q-4cqr-7g7w- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
xml2rfc allows script elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.
Sample XML snippet:
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>
Impact
This vulnerability impacts website that publish HTML drafts and RFCs.
Patches
This has been fixed in version 3.12.4.
Workarounds
If SVG source is self-contained within the XML, scraping script elements from SVG files.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in xml2rfc
- Email us at operational-vulnerability@ietf.org
- Infrastructure and Services Vulnerability Disclosure
- Record
GHSA-cf4q-4cqr-7g7w- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 99 versions. The JSON record has them.