CVE-2020-7750: Mit Scratch-Svg-Renderer

Critical severity, CVSS 9.6. EPSS: 6.1% chance of exploitation in the next 30 days.

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

Affected products

• Mit Scratch-Svg-Renderer: version 0.1.0 only; version 0.2.0 only

Published 2020-10-21. Last modified 2026-06-17.