[4.x]: svg-sanitize has Cross-site Scripting Bypass [CVE-2023-28426]

[cuebit]

What happened?

Description

The following security vulnerability is blocking our deployment pipelines.

Package	enshrined/svg-sanitize
CVE	CVE-2023-28426
Title	svg-sanitizer has Cross-site Scripting Bypass
URL	GHSA-xrqq-wqh4-5hg2
Affected versions	<0.16.0
Reported at	2023-03-20T20:44:30+00:00

Steps to reproduce

composer require craftcms/cms && composer audit

Workarounds

There is currently no workaround available without upgrading.

Craft CMS version

4.4.4

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

No response

[kbergha]

PR from Dependabot: #12936

[brandonkelly]

Thanks for bringing this to our attention! Craft 3.8.5 and 4.4.5 are out with the svg-sanitize dependency bumped to ~0.16.0.