« Volver al listado

CVE-2023-40013

Estado: ModificadaMedia (5.4)—

SVG Loader es una biblioteca de JavaScript que obtiene archivos SVG mediante XMLHttpRequests e inyecta el código SVG en el lugar de la etiqueta. Según la documentación, svg-loader elimina todo el código JS antes de inyectar el archivo SVG por razones de seguridad, pero la lógica de saneamiento de la entrada no es suficiente y puede eludirse fácilmente. Esto permite a un atacante crear un SVG malicioso que puede provocar una secuencia de comandos en sitios cruzados (XSS).

Leer descripción completaMostrar menos

Al intentar sanear el SVG, la biblioteca elimina atributos de eventos como `onmouseover`, `onclick`, pero la lista de eventos no es exhaustiva. Cualquier sitio web que utilice external-svg-loader y permita a sus usuarios proporcionar el origen (src) de un SVG o subir archivos SVG sería vulnerable a un ataque XSS almacenado. Este problema se ha solucionado en el commit `d3562fc08`, que se incluye en las versiones a partir de la 1.6.9. Se recomienda a los usuarios actualizar. No existen soluciones alternativas conocidas para esta vulnerabilidad.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Shubhamjain — SVG Loader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-40013",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-40013",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T20:29:25.846454Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "shubhamjain",
          "product": "svg-loader",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.6.9"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:shubhamjain:svg_loader:*:*:*:*:*:*:*:*"
          ],
          "vendor": "shubhamjain",
          "product": "svg_loader",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.6.9",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-14T21:15:13.523",
  "references": [
    {
      "url": "https://github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/commit/d3562fc08497aec5f33eb82017fa1417b3319e2c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/commit/d3562fc08497aec5f33eb82017fa1417b3319e2c",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/security/advisories/GHSA-xc2r-jf2x-gjr8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in Cross-site Scripting (XSS). When trying to sanitize the svg the lib removes event attributes such as `onmouseover`, `onclick` but the list of events is not exhaustive.  Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack. This issue has been addressed in commit `d3562fc08` which is included in releases from 1.6.9. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    }
  ],
  "lastModified": "2026-06-17T06:15:44.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shubhamjain:svg_loader:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1440C87D-1C44-4FB4-BAB5-D5A90A6DAEED",
              "versionEndExcluding": "1.6.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}