Rudloff

Incomplete filtering allows attackers to bypass the removal of remote URLs by utilizing CSS escape sequences within the `url()` function in SVG presentation attributes. By providing SVG files with attributes such as `fill` containing escaped slashes, browsers resolve these to remote URLs, which triggers external requests and enables data exfiltration.

Orejime, a consent manager focusing on accessibility, had a flaw where malicious code could be executed on HTML elements it handled. This occurred because the software, prior to version 2.3.2, would execute `javascript:` code embedded within data attributes when processing consent related to a purpose. Specifically, the software would convert `data-href` attributes into `href` attributes, triggering the code execution. This issue primarily affects setups where HTML code can be injected into pages. The vulnerable process involves transforming data attributes into unprefixed attributes.

The issue exists due to some Twig filters in CodeExtension using `is safe=html` but not ensuring their input is safe. This could allow a remote attacker to disclose protected information, perform phishing attacks, and conduct drive-by downloads. Symfony now escapes the output of the affected filters to resolve the issue.

AllTube is an HTML front end for youtube-dl. An attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack, depending on how AllTube is configured. The impact is mitigated by the fact that the SSRF attack is only possible when the `stream` option is enabled in the configuration, which is disabled by default.