Threats tagged 'ghsa-9cpr-c5m9-prfr'

ragent version 1.1.0 has a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts by uploading SVG documents. These SVG files are served inline with the image/svg+xml MIME type, causing scripts within them to execute in the context of the application when other users view the documents. This can lead to account takeover scenarios.