search

dompdf / php-svg-lib

SVG file parsing / rendering library
GNU Lesser General Public License v3.0
1.4k stars 77 forks source link

Critical Security breach through Sabberworm (code injection) #69

Closed Jany-M closed 2 years ago

Jany-M commented 2 years ago

As mentioned in detail here, the Sabberworm library has a HUGE vulnerability and can be used to compromise critically any website.

My specific case was with a WordPress site that had malicious js injected into EVERY single .js file (core, plugins, theme).

The issue was also raised here, since it uses the PHP SVG library.

PowerKiKi commented 2 years ago

Closing this issue to keep the discussion in a single place, https://github.com/sabberworm/PHP-CSS-Parser/issues/343, until we better understand what is going on.