Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2020-005

SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included i…

Published Mar 4, 2020 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

SVG Formatter module provides support for using SVG images on your website.

This security release fixes third-party dependencies included in or required by SVG Formatter. [XSS bypass using entities and tab](https://github.com/darylldoyle/svg-sanitizer/issues/31).

This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/svg_formatter < 1.12.0 1.12.0 DRUPAL-CONTRIB-2020-005

References