{"action":"Upgrade enshrined/svg-sanitize to 0.12.0 or later.","affected":[{"fixed":"0.12.0","introduced":"0"}],"component":"enshrined/svg-sanitize","cve_ids":["CVE-2019-18857"],"ecosystem":"Packagist","epss":0.01036,"exploited":false,"fixed_versions":["0.12.0"],"ghsa_id":"GHSA-gf8j-v8x5-h9qp","id":"tcs_01M5KF2NQNST3S639A3QB916K2","modified_at":"2023-11-08T04:01:26.579900Z","published_at":"2020-01-08T17:15:37Z","references":["https://osv.dev/vulnerability/GHSA-gf8j-v8x5-h9qp","https://nvd.nist.gov/vuln/detail/CVE-2019-18857","https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0","https://github.com/darylldoyle/svg-sanitizer","https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gf8j-v8x5-h9qp","url":"https://osv.dev/vulnerability/GHSA-gf8j-v8x5-h9qp"}],"summary":"XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes"}