CVE-2022-28284

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances

High · published December 22, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00585 · 47.2th percentile
Published
2022-12-22T00:00Z
EPSS history
Timeline
  • 22 DEC 00:00Z
    SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances
    cvelistv5