Threats tagged 'ghsa-w5hc-8c8h-8vm3'

svg-sanitizer versions before 1.1.0 have a cross-site scripting (XSS) vulnerability that allows attackers to bypass sanitization by embedding javascript: URLs in the animateTransform values attribute. This flaw enables crafted SVG files to execute arbitrary JavaScript in Safari when users click on links targeted by animateTransform. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.