9.6

CVE-2020-7750: mit scratch-svg-renderer Cross-site Scripting

CVSS: 9.6v3.1CriticalModified
AliasesGHSA-j977-g5vj-j27gSNYK-JS-SCRATCHSVGRENDERER-1020497
Published 21-10-2020Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2020-7750 is a critical (CVSS 9.6) Cross-site Scripting vulnerability in mit scratch-svg-renderer. EPSS estimates a 6.13% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.6/10
010
Critical · v3.1 (CVE.org)
EPSS score
6.13%
0%100%
Low · -0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Timeline

  1. 21-10-2020
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

6.13%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

-0.02 pp

From 6.15% on 19-09-2026

19-09-202619-10-2026
EPSS score
6.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databasemultipleUnverified

    Scratch Desktop 3.17 - Remote Code Execution

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Mit1 product
  • scratch-svg-renderer0.1.0 | 0.1.0:prerelease1515799461 | 0.1.0:prerelease1515800444 | 0.1.0:prerelease20180117145116 | 0.1.0:prerelease20180117210827 | 0.1.0:prerelease20180118201049 | 0.1.0:prerelease20180118201241 | 0.1.0:prerelease20180118224509 | 0.1.0:prerelease20180124043252 | 0.1.0:prerelease20180124054052 | 0.1.0:prerelease20180210005926 | 0.1.0:prerelease20180329174139 | 0.1.0:prerelease20180423193917 | 0.1.0:prerelease20180508170432 | 0.1.0:prerelease20180510171850 | 0.1.0:prerelease20180510181711 | 0.1.0:prerelease20180511144653 | 0.1.0:prerelease20180514170126 | 0.1.0:prerelease20180521194642 | 0.1.0:prerelease20180524204036 | 0.1.0:prerelease20180524210316 | 0.1.0:prerelease20180531205843 | 0.1.0:prerelease20180531214630 | 0.1.0:prerelease20180605140533 | 0.2.0:prerelease20180605154326 | 0.2.0:prerelease20180607141644 | 0.2.0:prerelease20180613184320 | 0.2.0:prerelease20180618172917 | 0.2.0:prerelease20180711180400 | 0.2.0:prerelease20180712223402 | 0.2.0:prerelease20180817005452 | 0.2.0:prerelease20180821210632 | 0.2.0:prerelease20180907141232 | 0.2.0:prerelease20180926143036 | 0.2.0:prerelease20181017193458 | 0.2.0:prerelease20181024192149 | 0.2.0:prerelease20181101210634 | 0.2.0:prerelease20181126212715 | 0.2.0:prerelease20181212190400 | 0.2.0:prerelease20181212222326 | 0.2.0:prerelease20181212230607 | 0.2.0:prerelease20181213165142 | 0.2.0:prerelease20181213192400 | 0.2.0:prerelease20181218153528 | 0.2.0:prerelease20181220183040 | 0.2.0:prerelease20190109201344 | 0.2.0:prerelease20190110205335 | 0.2.0:prerelease20190125192231 | 0.2.0:prerelease20190304180800 | 0.2.0:prerelease20190329052730 | 0.2.0:prerelease20190419183947 | 0.2.0:prerelease20190521170426 | 0.2.0:prerelease20190523193400 | 0.2.0:prerelease20190715144718 | 0.2.0:prerelease20190715153806 | 0.2.0:prerelease20190820171249 | 0.2.0:prerelease20190822193232 | 0.2.0:prerelease20190822202608 | 0.2.0:prerelease20191031221353 | 0.2.0:prerelease20191104164753 | 0.2.0:prerelease20191217211338 | 0.2.0:prerelease20200103191258 | 0.2.0:prerelease20200103211543 | 0.2.0:prerelease20200109070519 | 0.2.0:prerelease20200205003215 | 0.2.0:prerelease20200205003400 | 0.2.0:prerelease20200507183648 | 0.2.0:prerelease20200604203226 | 0.2.0:prerelease20200609210443 | 0.2.0:prerelease20200610220938 | 0.2.0:prerelease20201008203328 | 0.2.0:prerelease20201009194722 | 0.2.0:prerelease20201009195807 | 0.2.0:prerelease20201009202925 | 0.2.0:prerelease20201009211507 | 0.2.0:prerelease20201011114003 | 0.2.0:prerelease20201012151417 | 0.2.0:prerelease20201013123302 | 0.2.0:prerelease20201013184332 | 0.2.0:prerelease20201014105708 | 0.2.0:prerelease20201014130133 | 0.2.0:prerelease20201014145347 | 0.2.0:prerelease20201015122106 | 0.2.0:prerelease20201015135047 | 0.2.0:prerelease20201015194358 | 0.2.0:prerelease20201016121710
Npm1 product
  • scratch-svg-renderer< 0.2.0-prerelease.20201019174008

2 vendors · 2 products

References

3 links