Threats tagged 'ghsa-crrh-v25v-h623'

The darylldoyle svg-sanitizer library versions before 1.0.0 contain vulnerabilities related to CSS injection and remote reference bypass. These flaws allow attackers to embed external resources by uploading crafted SVG files. Exploitation can involve unsanitized style content, unquoted url() values, or image href attributes, potentially leading to data exfiltration, user tracking, or visitor IP disclosure.