Missed script escape scenario #3087

New Issue

OVERLORD · 2026-02-05T06:02:00+03:00

OVERLORD commented

2026-02-05 06:02:00 +03:00

Originally created by @ssddanbrown on GitHub (Sep 6, 2022).

Originally assigned to: @ssddanbrown on GitHub.

Is prevented by CSP already, but good to prevent this case to benefit out-of-platform cases.

cases:

  Example 1)
  <svg><animate href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>
  Example 2)
  <svg><set href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>

Thanks to the "JPCERT/CC Vulnerability Coordination Group" contact and the original reporter, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc, again for disclosing of this case.

Originally created by @ssddanbrown on GitHub (Sep 6, 2022). Originally assigned to: @ssddanbrown on GitHub. Is prevented by CSP already, but good to prevent this case to benefit out-of-platform cases. cases: ```html Example 1) <svg><animate href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a> Example 2) <svg><set href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a> ``` Thanks to the "JPCERT/CC Vulnerability Coordination Group" contact and the original reporter, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc, again for disclosing of this case.

OVERLORD added the 🛠️ Enhancement 🔒 Security labels 2026-02-05 06:02:00 +03:00

OVERLORD closed this issue

2026-02-05 06:02:01 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3087