{"id":"GHSA-8xqr-4cpm-wx7g","aliases":[],"status":"published","title":"Cross-Site Scripting in react-svg","description":"Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.\n\n\n## Recommendation\n\nUpdate to version 2.2.18 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-05-31T23:47:27Z","modified":"2023-01-09T05:01:22Z","fixes":[{"ecosystem":"npm","package":"react-svg","fixed_in":["2.2.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.18"}]}]},{"source":"osv","ecosystem":"npm","package":"react-svg","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.18"}]}]}],"references":[{"url":"https://github.com/tanem/react-svg/pull/57","tags":["web"]},{"url":"https://github.com/tanem/react-svg/pull/57/commits/ec7de5d678f53a085cee1348cb1aa069c9fc42fb","tags":["web"]},{"url":"https://www.npmjs.com/advisories/648","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8xqr-4cpm-wx7g"}],"sources":{"ghsa":[{"id":"GHSA-8xqr-4cpm-wx7g","title":"Cross-Site Scripting in react-svg","description":"Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.\n\n\n## Recommendation\n\nUpdate to version 2.2.18 or later.","status":"published","published":"2019-05-31T23:47:27Z","modified":"2023-01-09T05:01:22Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-8xqr-4cpm-wx7g","title":"Cross-Site Scripting in react-svg","description":"Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.\n\n\n## Recommendation\n\nUpdate to version 2.2.18 or later.","status":"published","published":"2019-05-31T23:47:27Z","modified":"2020-08-31T18:31:14Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}