SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
xml2rfc allows script elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.
Sample XML snippet:
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>Impact
This vulnerability impacts website that publish HTML drafts and RFCs.
Patches
This has been fixed in version 3.12.4.
Workarounds
If SVG source is self-contained within the XML, scraping script elements from SVG files.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in xml2rfc
- Email us at operational-vulnerability@ietf.org
- Infrastructure and Services Vulnerability Disclosure
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | xml2rfc | < 3.12.4 | 3.12.4 |
References
- Weakness (CWE)
CWE-79- Platform
- Python (PyPI)
- Package
xml2rfc- Disclosed
- 22.04.2022
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cf4q-4cqr-7g7w - CC BY 4.0
Vulnerability history: xml2rfc
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 04.2022 09.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 3
- 2026: 0
-
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.