{"action":"Upgrade external-svg-loader to 1.6.9 or later.","affected":[{"fixed":"1.6.9","introduced":"0"}],"component":"external-svg-loader","cve_ids":["CVE-2023-40013"],"ecosystem":"npm","epss":0.00558,"exploited":false,"fixed_versions":["1.6.9"],"ghsa_id":"GHSA-xc2r-jf2x-gjr8","id":"tcs_01M5KGHK2KZ5SQF86R62W1RZD5","modified_at":"2026-09-10T03:50:03.021794173Z","published_at":"2023-08-14T21:32:27Z","references":["https://osv.dev/vulnerability/GHSA-xc2r-jf2x-gjr8","https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8","https://nvd.nist.gov/vuln/detail/CVE-2023-40013","https://github.com/shubhamjain/svg-loader/commit/d3562fc08497aec5f33eb82017fa1417b3319e2c","https://github.com/shubhamjain/svg-loader","https://github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128","https://github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-xc2r-jf2x-gjr8","url":"https://osv.dev/vulnerability/GHSA-xc2r-jf2x-gjr8"}],"summary":"external-svg-loader Cross-site Scripting vulnerability"}