CVE-2019-10772

Name of the Vulnerable Software and Affected Versions svg-sanitize versions prior to 0.13.1

Description The issue arises from the mishandling of the xlink namespace by the sanitizer, allowing bypass of svg-sanitize using the xlink:href attribute.

Recommendations For versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xlink:href attribute in the sanitizer until a patch is available.