critical9.6Public exploit code
CVE-2020-7750
Cross-Site Scripting in scratch-svg-renderer
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Scratch Desktop 3.17 - Remote Code Execution2021-07-02 · webapps · multiple
Impact
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | scratch-svg-renderer | <= 0.2.0-prerelease.20201016121710 | 0.2.0-prerelease.20201019174008 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mit | Scratch-Svg-Renderer | Versions 0.1.0, 0.2.0 |