Description
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | enshrined/svg-sanitize | < 0.12.0 | 0.12.0 | GHSA-gf8j-v8x5-h9qp |