{"id":"CVE-2022-23638","aliases":["EUVD-2022-0990","GHSA-fqx8-v33p-4qcc","UBUNTU-CVE-2022-23638","USN-7318-1"],"status":"published","title":"Cross-site Scripting in svg-sanitizer","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00679,"percentile":0.52788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-02-14T21:10:10Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Packagist","package":"enshrined/svg-sanitize","fixed_in":["0.15.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"enshrined/svg-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.11.0","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.5.3","0.5.3.1","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.11-3","3.2.12-1","4.0.2-1","4.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.11+dfsg-1","4.1.12+dfsg-1","4.1.13+dfsg-1","4.1.15+dfsg-1","4.2.9+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.8+dfsg-1","4.4.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.9+dfsg-1","4.4.15+dfsg-1","4.4.16+dfsg-1","4.4.19+dfsg-1","4.4.20+dfsg-1","4.4.21+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3+dfsg-1","4.4.6+dfsg-1","4.4.7+dfsg-1","4.4.8+dfsg-1","4.4.9+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-4~deb9u5ubuntu0.1~esm2"}]}],"versions":["3.1.4-3","3.1.4-4~deb9u3build0.18.04.1","3.1.4-4~deb9u5build0.18.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"spip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu0.1+esm2"}]}],"versions":["3.2.4-1","3.2.5-1","3.2.7-1","3.2.7-1ubuntu0.1"],"bundled":8}],"products":[{"vendor":"darylldoyle","product":"svg-sanitizer"},{"vendor":"svg-sanitizer_project","product":"svg-sanitizer"}],"references":[{"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-fqx8-v33p-4qcc","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/commit/17e12ba9c2881caa6b167d0fbea555c11207fbb0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23638","tags":["advisory"]},{"url":"https://github.com/darylldoyle/svg-sanitizer/issues/71","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/enshrined/svg-sanitize/CVE-2022-23638.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fqx8-v33p-4qcc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23638.json","tags":["advisory"]},{"url":"https://github.com/darylldoyle/svg-sanitizer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-23638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23638","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7318-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8517","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-23638","title":"Cross-site Scripting in svg-sanitizer","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","status":"published","published":"2022-02-14T21:10:10Z","modified":"2025-04-23T19:05:21.988Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-0990","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","status":"published","published":"2022-02-14T21:10:10Z","modified":"2025-04-23T19:05:21Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:07.453218Z"}],"ghsa":[{"id":"GHSA-fqx8-v33p-4qcc","title":"Cross-site Scripting in enshrined/svg-sanitize","description":"### Impact\nSVG sanitizer library before version `0.15.0` did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as `text/html`) was susceptible to cross-site scripting. Plain SVG files (fetched as `image/svg+xml`) were not affected.\n\n### Patches\nThis issue is fixed in `0.15.0` and higher.\n\n### Workarounds\nThere is currently no workaround available without upgrading.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Github](https://github.com/darylldoyle/svg-sanitizer/issues)\n* Email us at [daryll@enshrined.co.uk](mailto:daryll@enshrined.co.uk)\n","status":"published","published":"2022-02-14T22:54:18Z","modified":"2024-02-05T10:42:41Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2022-23638","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","status":"published","published":"2022-02-14T21:15:09.853Z","modified":"2026-06-17T04:30:32.3Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"CVE-2022-23638","title":"Cross-site Scripting in svg-sanitizer","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","status":"published","published":"2022-02-14T21:10:10Z","modified":"2026-10-28T02:31:03.700825777Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-fqx8-v33p-4qcc","title":"Cross-site Scripting in enshrined/svg-sanitize","description":"### Impact\nSVG sanitizer library before version `0.15.0` did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as `text/html`) was susceptible to cross-site scripting. Plain SVG files (fetched as `image/svg+xml`) were not affected.\n\n### Patches\nThis issue is fixed in `0.15.0` and higher.\n\n### Workarounds\nThere is currently no workaround available without upgrading.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Github](https://github.com/darylldoyle/svg-sanitizer/issues)\n* Email us at [daryll@enshrined.co.uk](mailto:daryll@enshrined.co.uk)\n","status":"published","published":"2022-02-14T22:54:18Z","modified":"2024-02-16T08:20:28.669768Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2022-23638","description":"svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.","status":"published","published":"2022-02-14T21:15:00Z","modified":"2026-10-17T12:56:02.230157414Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"USN-7318-1","title":"spip vulnerabilities","description":"It was discovered that svg-sanitizer, vendored in SPIP, did not properly\nsanitize SVG/XML content. An attacker could possibly use this issue to\nperform cross site scripting. This issue only affected Ubuntu 24.10.\n(CVE-2022-23638)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform cross site\nscripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform PHP injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote authenticated attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-37155)\n\nIt was discovered that SPIP did not properly sanitize certain inputs. A\nremote attacker could possibly use this issue to perform SQL injection\nattacks. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2023-24258)\n\nIt was discovered that SPIP did not properly handle serialization under\ncertain circumstances. A remote attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2023-27372)\n\nIt was discovered that SPIP did not properly sanitize HTTP requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2024-8517)\n","status":"published","published":"2025-03-04T00:21:21Z","modified":"2026-04-27T18:02:20.676823681Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}