Threats tagged 'ghsa-53pr-f2w2-phx8'

A cross-site scripting (XSS) vulnerability exists in DataEase up to version 2.10.27 in the StaticResourceServer.validateSvgContent function of the SVG Handler component. This flaw allows remote attackers to execute script code by manipulating SVG content. The issue is resolved in version 2.10.28 with improved SVG security measures including namespace-aware allowlists and restrictive Content Security Policy.