GHSA-6hvg-62q8-95v7

Suggest an improvement
Source
https://github.com/advisories/GHSA-6hvg-62q8-95v7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-6hvg-62q8-95v7/GHSA-6hvg-62q8-95v7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6hvg-62q8-95v7
Aliases
Published
2023-10-20T13:23:32Z
Modified
2023-11-08T04:13:40Z
Summary
svg_optimizer rubygem external XML entity (XXE) vulnerability
Details

An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content.

Database specific 
{
    "cwe_ids":  [
        "CWE-611"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-10-20T13:23:32Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / svg_optimizer

Package

Name
svg_optimizer
Purl
pkg:gem/svg_optimizer

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.2.6
Fixed
0.3.0

Affected versions

0.*
0.2.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-6hvg-62q8-95v7/GHSA-6hvg-62q8-95v7.json"