CVE-2020-7750
Summary
| CVE | CVE-2020-7750 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-21 17:15:00 UTC |
| Updated | 2020-12-02 20:24:00 UTC |
| Description | This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mit | Scratch-svg-renderer | 0.1.0 | - | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease1515799461 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease1515800444 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180117145116 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180117210827 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118201049 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118201241 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118224509 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180124043252 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180124054052 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180210005926 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180329174139 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180423193917 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180508170432 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180510171850 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180510181711 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180511144653 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180514170126 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180521194642 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180524204036 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180524210316 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180531205843 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180531214630 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180605140533 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180605154326 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180607141644 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180613184320 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180618172917 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180711180400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180712223402 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180817005452 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180821210632 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180907141232 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180926143036 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181017193458 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181024192149 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181101210634 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181126212715 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212190400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212222326 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212230607 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181213165142 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181213192400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181218153528 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181220183040 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190109201344 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190110205335 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190125192231 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190304180800 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190329052730 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190419183947 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190521170426 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190523193400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190715144718 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190715153806 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190820171249 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190822193232 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190822202608 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191031221353 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191104164753 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191217211338 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200103191258 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200103211543 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200109070519 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200205003215 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200205003400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200507183648 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200604203226 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200609210443 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200610220938 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201008203328 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009194722 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009195807 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009202925 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009211507 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201011114003 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201012151417 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201013123302 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201013184332 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014105708 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014130133 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014145347 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015122106 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015135047 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015194358 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201016121710 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | - | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease1515799461 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease1515800444 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180117145116 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180117210827 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118201049 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118201241 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180118224509 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180124043252 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180124054052 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180210005926 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180329174139 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180423193917 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180508170432 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180510171850 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180510181711 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180511144653 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180514170126 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180521194642 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180524204036 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180524210316 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180531205843 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180531214630 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.1.0 | prerelease20180605140533 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180605154326 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180607141644 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180613184320 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180618172917 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180711180400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180712223402 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180817005452 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180821210632 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180907141232 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20180926143036 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181017193458 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181024192149 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181101210634 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181126212715 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212190400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212222326 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181212230607 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181213165142 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181213192400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181218153528 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20181220183040 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190109201344 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190110205335 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190125192231 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190304180800 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190329052730 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190419183947 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190521170426 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190523193400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190715144718 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190715153806 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190820171249 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190822193232 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20190822202608 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191031221353 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191104164753 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20191217211338 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200103191258 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200103211543 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200109070519 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200205003215 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200205003400 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200507183648 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200604203226 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200609210443 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20200610220938 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201008203328 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009194722 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009195807 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009202925 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201009211507 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201011114003 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201012151417 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201013123302 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201013184332 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014105708 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014130133 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201014145347 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015122106 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015135047 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201015194358 | All | All |
| Application | Mit | Scratch-svg-renderer | 0.2.0 | prerelease20201016121710 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cross-site Scripting (XSS) in scratch-svg-renderer | Snyk | MISC | snyk.io | Third Party Advisory |
| Merge pull request #179 from LLK/hotfix/purify-just-in-time · LLK/scratch-svg-renderer@9ebf575 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: apple502j
Legacy QID Mappings
- 983217 Nodejs (npm) Security Update for scratch-svg-renderer (GHSA-j977-g5vj-j27g)