Unratedcrates.ioPublished
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences
GHSA-3c48-9r95-hqhr
- Affected
- crates.io kuva >= 0.1.5, < 0.3.1; >= 0.4.0, < 0.4.1
- Fixed in
- 0.3.10.4.1· Vendor fix available
- Issue
- Affected versions of `kuva` wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places. 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity was enabled via `Layout::with_interactive`, group and category labels were formatted directly into `data-group` and `data-x` attributes through the raw `Primitive::GroupStart.extra_attrs` string, which the SVG backend emitted verbatim. The backend's escaping helper covered text nodes and ` ` but not attributes. A label containing a double quote could close the attribute and add another, for example an event handler. Opening the resulting SVG in a browser, or inlining it into an HTML page, executed the injected script. Reachable from scatter, line, bar, and strip plots, and from legends. 2. Unvalidated CSS and style attribute values (CWE-74).…
Recommended action: Upgrade to 0.4.1 or 0.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.