RubyGems/inline_svg CVE-2020-36644: medium 6.1, EPSS 0.71%

Inline SVG vulnerable to Cross-site Scripting

Action: Upgrade inline_svg to 1.7.2 or later.

bundle update inline_svg

Affected

Fixed versions

Sources

• osv: GHSA-p33q-4h4m-j994
• https://nvd.nist.gov/vuln/detail/CVE-2020-36644
• https://github.com/jamesmartin/inline_svg/pull/117
• https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621
• https://github.com/jamesmartin/inline_svg
• https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/inline_svg/CVE-2020-36644.yml
• https://vuldb.com/?ctiid.217597
• https://vuldb.com/?id.217597

CVE-2020-36644 · published 2023-01-07T12:30:14Z · modified 2023-11-08T04:03:48.841837Z · JSON