Medium severity5.4NVD Advisory· Published May 13, 2020· Updated Jun 17, 2026

CVE-2020-11070

Description

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
t3g/svg-sanitizerPackagist	< 1.0.3	1.0.3

Affected products

TYPO3/Svg Sanitizer
cpe:2.3:a:typo3:svg_sanitizer:*:*:*:*:*:*:*:*
Range: <1.0.3
ghsa-coords
pkg:composer/t3g/svg-sanitizer
Range: < 1.0.3
TYPO3GmbH/svg_sanitizerv5
Range: < 1.0.3

Patches

Vulnerability mechanics

References

github.com/TYPO3GmbH/svg_sanitizer/security/advisories/GHSA-59cf-m7v5-wh5wnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-59cf-m7v5-wh5wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-11070ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000