medium5.4
CVE-2025-56514
Fiora chat user avatar is vulnerable to XSS via SVG files
Impact
Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fiora | = 1.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suisuijiang | Fiora | Version 1.0.0 |