Threats tagged 'ghsa-82gx-99vw-x254'

The svg-sanitizer library versions from 0.11.0 up to but not including 1.1.0 contain a vulnerability where submitting well-formed XML documents without a top-level svg root element causes an uncaught exception. Specifically, supplying documents with a non-svg root or nested svg element triggers a LogicException in the Sanitizer::sanitize() function, leading to crashes or bypassing upload rejection.