{"id":"GHSA-6hvg-62q8-95v7","summary":"svg_optimizer rubygem external XML entity (XXE) vulnerability","details":"An issue in Fnando svg_optimizer v.0.2.6 allows a remote attacker to escalate privileges when optimizing untrusted SVG content.\n","aliases":["CVE-2023-46035"],"modified":"2023-11-08T04:13:40.269769Z","published":"2023-10-20T13:23:32Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-10-20T13:23:32Z","nvd_published_at":null,"cwe_ids":["CWE-611"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/fnando/svg_optimizer/pull/17"},{"type":"WEB","url":"https://github.com/fnando/svg_optimizer/commit/8244ff25b51a16892496e9d9f7191dba393f7af0"},{"type":"WEB","url":"https://github.com/fnando/svg_optimizer/commit/b1b5013db297494daba5676b9fa4423ffc5e96fa"},{"type":"PACKAGE","url":"https://github.com/fnando/svg_optimizer"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/svg_optimizer/CVE-2023-46035.yml"}],"affected":[{"package":{"name":"svg_optimizer","ecosystem":"RubyGems","purl":"pkg:gem/svg_optimizer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.6"},{"fixed":"0.3.0"}]}],"versions":["0.2.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-6hvg-62q8-95v7/GHSA-6hvg-62q8-95v7.json"}}],"schema_version":"1.9.0"}