{"schemaVersion":3,"id":"CVE-2020-7750","aliases":["GHSA-j977-g5vj-j27g","SNYK-JS-SCRATCHSVGRENDERER-1020497"],"status":"published","duplicateOf":null,"title":null,"description":"This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.","dates":{"published":"2020-10-21T16:20:12.796Z","modified":"2024-09-16T19:31:46.720Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.6,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.6,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":9.6,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","exploitability":7.2,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.6,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.06125,"percentile":0.93371,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.023000000000000104,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.06148},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06125,"percentile":0.93371}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.06148,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06125,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06125,"percentile":0.93371}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"50079","name":"Scratch Desktop 3.17 - Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/50079","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/50079.txt","codes":["CVE-2020-7750"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"mit","product":"scratch-svg-renderer","name":"scratch-svg-renderer","label":"scratch-svg-renderer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.1.0","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease1515799461","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease1515800444","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180117145116","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180117210827","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180118201049","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180118201241","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180118224509","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180124043252","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180124054052","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180210005926","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180329174139","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180423193917","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180508170432","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180510171850","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180510181711","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180511144653","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180514170126","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180521194642","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180524204036","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180524210316","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180531205843","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180531214630","noFixRecorded":false,"fixedIn":null},{"text":"0.1.0:prerelease20180605140533","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180605154326","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180607141644","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180613184320","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180618172917","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180711180400","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180712223402","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180817005452","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180821210632","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180907141232","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20180926143036","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181017193458","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181024192149","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181101210634","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181126212715","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181212190400","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181212222326","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181212230607","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181213165142","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181213192400","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181218153528","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20181220183040","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190109201344","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190110205335","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190125192231","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190304180800","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190329052730","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190419183947","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190521170426","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190523193400","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190715144718","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190715153806","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190820171249","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190822193232","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20190822202608","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20191031221353","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20191104164753","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20191217211338","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200103191258","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200103211543","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200109070519","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200205003215","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200205003400","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200507183648","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200604203226","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200609210443","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20200610220938","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201008203328","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201009194722","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201009195807","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201009202925","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201009211507","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201011114003","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201012151417","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201013123302","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201013184332","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201014105708","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201014130133","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201014145347","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201015122106","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201015135047","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201015194358","noFixRecorded":false,"fixedIn":null},{"text":"0.2.0:prerelease20201016121710","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.1.0 | 0.1.0:prerelease1515799461 | 0.1.0:prerelease1515800444 | 0.1.0:prerelease20180117145116 | 0.1.0:prerelease20180117210827 | 0.1.0:prerelease20180118201049 | 0.1.0:prerelease20180118201241 | 0.1.0:prerelease20180118224509 | 0.1.0:prerelease20180124043252 | 0.1.0:prerelease20180124054052 | 0.1.0:prerelease20180210005926 | 0.1.0:prerelease20180329174139 | 0.1.0:prerelease20180423193917 | 0.1.0:prerelease20180508170432 | 0.1.0:prerelease20180510171850 | 0.1.0:prerelease20180510181711 | 0.1.0:prerelease20180511144653 | 0.1.0:prerelease20180514170126 | 0.1.0:prerelease20180521194642 | 0.1.0:prerelease20180524204036 | 0.1.0:prerelease20180524210316 | 0.1.0:prerelease20180531205843 | 0.1.0:prerelease20180531214630 | 0.1.0:prerelease20180605140533 | 0.2.0:prerelease20180605154326 | 0.2.0:prerelease20180607141644 | 0.2.0:prerelease20180613184320 | 0.2.0:prerelease20180618172917 | 0.2.0:prerelease20180711180400 | 0.2.0:prerelease20180712223402 | 0.2.0:prerelease20180817005452 | 0.2.0:prerelease20180821210632 | 0.2.0:prerelease20180907141232 | 0.2.0:prerelease20180926143036 | 0.2.0:prerelease20181017193458 | 0.2.0:prerelease20181024192149 | 0.2.0:prerelease20181101210634 | 0.2.0:prerelease20181126212715 | 0.2.0:prerelease20181212190400 | 0.2.0:prerelease20181212222326 | 0.2.0:prerelease20181212230607 | 0.2.0:prerelease20181213165142 | 0.2.0:prerelease20181213192400 | 0.2.0:prerelease20181218153528 | 0.2.0:prerelease20181220183040 | 0.2.0:prerelease20190109201344 | 0.2.0:prerelease20190110205335 | 0.2.0:prerelease20190125192231 | 0.2.0:prerelease20190304180800 | 0.2.0:prerelease20190329052730 | 0.2.0:prerelease20190419183947 | 0.2.0:prerelease20190521170426 | 0.2.0:prerelease20190523193400 | 0.2.0:prerelease20190715144718 | 0.2.0:prerelease20190715153806 | 0.2.0:prerelease20190820171249 | 0.2.0:prerelease20190822193232 | 0.2.0:prerelease20190822202608 | 0.2.0:prerelease20191031221353 | 0.2.0:prerelease20191104164753 | 0.2.0:prerelease20191217211338 | 0.2.0:prerelease20200103191258 | 0.2.0:prerelease20200103211543 | 0.2.0:prerelease20200109070519 | 0.2.0:prerelease20200205003215 | 0.2.0:prerelease20200205003400 | 0.2.0:prerelease20200507183648 | 0.2.0:prerelease20200604203226 | 0.2.0:prerelease20200609210443 | 0.2.0:prerelease20200610220938 | 0.2.0:prerelease20201008203328 | 0.2.0:prerelease20201009194722 | 0.2.0:prerelease20201009195807 | 0.2.0:prerelease20201009202925 | 0.2.0:prerelease20201009211507 | 0.2.0:prerelease20201011114003 | 0.2.0:prerelease20201012151417 | 0.2.0:prerelease20201013123302 | 0.2.0:prerelease20201013184332 | 0.2.0:prerelease20201014105708 | 0.2.0:prerelease20201014130133 | 0.2.0:prerelease20201014145347 | 0.2.0:prerelease20201015122106 | 0.2.0:prerelease20201015135047 | 0.2.0:prerelease20201015194358 | 0.2.0:prerelease20201016121710","eol":null,"hubHref":"/vendor/mit/scratch-svg-renderer"},{"vendor":"Npm","product":"scratch-svg-renderer","name":"scratch-svg-renderer","label":"scratch-svg-renderer","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/scratch-svg-renderer","purlType":"npm","versions":[{"text":"< 0.2.0-prerelease.20201019174008","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.2.0-prerelease.20201019174008","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497","label":"snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497","hostname":"snyk.io","tags":["X Refsource MISC","WEB","Third Party Advisory"]},{"url":"https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90","label":"github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90","hostname":"github.com","tags":["X Refsource MISC","WEB","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7750","label":"nvd.nist.gov/vuln/detail/CVE-2020-7750","hostname":"nvd.nist.gov","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-10-21T16:20:12.796Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T19:31:46.720Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:30:49.394Z","stale":false,"partial":false}}