{"id":"CVE-2023-46035","aliases":["EUVD-2023-60669","GHSA-6hvg-62q8-95v7"],"status":"published","title":"svg_optimizer rubygem external XML entity (XXE) vulnerability","description":"The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00366,"percentile":0.30738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611","CWE-776"],"published":"2023-10-20T13:23:32Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"RubyGems","package":"svg_optimizer","fixed_in":["0.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"svg_optimizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.6"},{"last_affected":"0.2.6"},{"fixed":"0.3.0"}]}],"versions":["0.2.6"]},{"source":"osv","ecosystem":"RubyGems","package":"svg_optimizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.6"},{"fixed":"0.3.0"}]}],"versions":["0.2.6"]}],"products":[{"vendor":"fnando","product":"svg_optimizer"}],"references":[{"url":"https://github.com/fnando/svg_optimizer/pull/17","tags":["fix","web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/pull/713","tags":["fix"]},{"url":"https://github.com/fnando/svg_optimizer/commit/8244ff25b51a16892496e9d9f7191dba393f7af0","tags":["web"]},{"url":"https://github.com/fnando/svg_optimizer/commit/b1b5013db297494daba5676b9fa4423ffc5e96fa","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/svg_optimizer/CVE-2023-46035.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6hvg-62q8-95v7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46035.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46035","tags":["advisory"]},{"url":"https://github.com/fnando/svg_optimizer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-46035","description":"The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-14T16:25:20.7Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-60669","description":"The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-14T16:25:20Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-6hvg-62q8-95v7","title":"svg_optimizer rubygem external XML entity (XXE) vulnerability","description":"An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content.\n","status":"published","published":"2023-10-20T13:23:32Z","modified":"2023-10-20T13:23:33Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2023-46035","description":"The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.","status":"published","published":"2026-09-14T06:16:54.5Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:09:27.733183Z"}],"osv":[{"id":"CVE-2023-46035","description":"The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-28T02:30:57.378074523Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"GHSA-6hvg-62q8-95v7","title":"svg_optimizer rubygem external XML entity (XXE) vulnerability","description":"An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content.\n","status":"published","published":"2023-10-20T13:23:32Z","modified":"2023-11-08T04:13:40.269769Z","cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}