CVE-2022-23638mediumCWE-79

CVE-2022-23638: fallo de gravedad media en darylldoyle svg-sanitizer

Cross-site Scripting in svg-sanitizer

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear svg-sanitizer+ Monitorear enshrined/svg-sanitize

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.2epss 0.7%
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
darylldoyle · svg-sanitizer
CVEs relacionadas — darylldoyle svg-sanitizer

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-55166MEDIUMsvg-sanitizer By-Passing Attribute SanitizationEPSS 0.5%CVE-2026-107379MEDIUMenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-121444HIGHsvg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference GraphEPSS 0.4%CVE-2026-121445HIGHsvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingEPSS 0.4%CVE-2026-117540HIGHsvg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping LoopEPSS 0.4%