https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:36:36 +0000 https://vulnerability.circl.lu/vuln/brew-xml2rfc-ghsa-cf4q-4cqr-7g7w <p><strong>Affected:</strong> Homebrew: xml2rfc</p> <p>xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks.</p> <p>Sample XML snippet: ``` &lt;artwork type=&#34;svg&#34; src=&#34;data:image/svg+xml,%3Csvg viewBox=&#39;0 0 10 10&#39; xmlns=&#39;http://www.w3.org/2000/svg&#39;%3E%3Cscript%3E window.alert(&#39;Test Alert&#39;); %3C/script%3E%3C/svg%3E&#34;&gt; &lt;/artwork&gt; ```</p> <p>### Impact This vulnerability impacts website that publish HTML drafts and RFCs.</p> <p>### Patches This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).</p> <p>### Workarounds If SVG source is self-contained within the XML, scraping `script` elements from SVG files.</p> <p>### References * https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/) * Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org) * [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)</p> <p><strong>Affected:</strong> Homebrew: xml2rfc</p> <p>xml2rfc allows `script` elements in SVG sources. In HTML output having these script elements can lead to XSS attacks.</p> <p>Sample XML snippet: ``` &lt;artwork type=&#34;svg&#34; src=&#34;data:image/svg+xml,%3Csvg viewBox=&#39;0 0 10 10&#39; xmlns=&#39;http://www.w3.org/2000/svg&#39;%3E%3Cscript%3E window.alert(&#39;Test Alert&#39;); %3C/script%3E%3C/svg%3E&#34;&gt; &lt;/artwork&gt; ```</p> <p>### Impact This vulnerability impacts website that publish HTML drafts and RFCs.</p> <p>### Patches This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).</p> <p>### Workarounds If SVG source is self-contained within the XML, scraping `script` elements from SVG files.</p> <p>### References * https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/) * Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org) * [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)</p> https://vulnerability.circl.lu/vuln/brew-xml2rfc-ghsa-cf4q-4cqr-7g7w