What’s Vulnerable › Vulnerabilities

CVE-2023-22461: sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-04 · updated 2026-06-17
• Weakness: CWE-79

Description

The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds

Affected products

• mattkrick sanitize-svg: before 0.4.0 — fixed in 0.4.0

How to fix

Upgrade to a fixed version: mattkrick sanitize-svg 0.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/mattkrick/sanitize-svg/commit/b107e453ede7b58adcccae74a3e474c012eec85d
• https://github.com/mattkrick/sanitize-svg/security/advisories/GHSA-h857-2g56-468g
• https://github.com/mattkrick/sanitize-svg/commit/b107e453ede7b58adcccae74a3e474c012eec85d
• https://github.com/mattkrick/sanitize-svg/security/advisories/GHSA-h857-2g56-468g

Get alerted when CVE-2023-22461 or the next vulnerability affects your stack