Project: 
SVG Formatter
Date: 
2022-March-09
Security risk: 
Critical 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All
Vulnerability: 
Cross Site Scripting
Affected versions: 
<1.17.0 || =2.0.0
Description: 

SVG Formatter module provides support for using SVG images on your website.

Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images.

Solution: 

Update the module (8.x-1.17 or 2.0.1) which will enable updating to the enshrined/svg-sanitize to version 0.15 or newer library.

The updated library is most easily installed with Composer. To update the module and library it's possible to run the following Composer command:

composer update --with-dependencies drupal/svg_formatter
Reported By: 
Fixed By: 
Coordinated By: