What’s Vulnerable › Vulnerabilities

CVE-2020-7750: Cross-site Scripting (XSS)

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-21 · updated 2026-06-17
• Weakness: CWE-79

Description

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

Affected products

• scratch-svg-renderer: 0.1.0, 0.1.0-prerelease1515799461, 0.1.0-prerelease1515800444, 0.1.0-prerelease20180117145116, 0.1.0-prerelease20180117210827, 0.1.0-prerelease20180118201049 (+80)

References

• https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
• https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497
• https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
• https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497

Get alerted when CVE-2020-7750 or the next vulnerability affects your stack