Skip to content
Fencer Intel
medium —

GHSA-cf4q-4cqr-7g7w json

SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc

published 4y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks.

Sample XML snippet: ``` <artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E"> </artwork> ```

### Impact This vulnerability impacts website that publish HTML drafts and RFCs.

### Patches This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).

### Workarounds If SVG source is self-contained within the XML, scraping `script` elements from SVG files.

### References * https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

### For more information If you have any questions or comments about this advisory: * Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/) * Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org) * [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)

Patch / fix

  • pypi xml2rfc 3.12.4

Is GHSA-cf4q-4cqr-7g7w in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi xml2rfc
<3.12.4
3.12.4

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.