CVE-2020-7750 | Cross-site Scripting (XSS)

Exp

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

Published: 2020-10-21 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2020-7750 is rated High Exploit Risk (84.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 6.18%, 91th percentile). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2020-7750

EDB-ID Source Kind Published Link
50079 exploit_db edb 2021-07-02 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2020-7750

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-04-05 6.95% 6.18% -0.77%
2 2025-11-21 4.93% 6.95% +2.02%
3 2025-11-18 — 4.93% —

Full EPSS history (15 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2020-7750

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.6 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.8 6.0 [email protected]
6.8 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 6.4 [email protected]

Weakness enumeration for CVE-2020-7750

GitHub Security Advisory for CVE-2020-7750

GHSA-j977-g5vj-j27g · Severity: high · Ecosystem: npm — Cross-Site Scripting in scratch-svg-renderer

Affected software / configurations for CVE-2020-7750

Vendor Product Version Raw CPE
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:-:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease1515799461:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease1515800444:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180117145116:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180117210827:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180118201049:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180118201241:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180118224509:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180124043252:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180124054052:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180210005926:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180329174139:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180423193917:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180508170432:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180510171850:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180510181711:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180511144653:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180514170126:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180521194642:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180524204036:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180524210316:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180531205843:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180531214630:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.1.0 cpe:2.3:a:mit:scratch-svg-renderer:0.1.0:prerelease20180605140533:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180605154326:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180607141644:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180613184320:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180618172917:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180711180400:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180712223402:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180817005452:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180821210632:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180907141232:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20180926143036:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181017193458:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181024192149:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181101210634:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181126212715:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181212190400:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181212222326:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181212230607:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181213165142:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181213192400:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181218153528:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20181220183040:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190109201344:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190110205335:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190125192231:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190304180800:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190329052730:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190419183947:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190521170426:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190523193400:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190715144718:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190715153806:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190820171249:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190822193232:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20190822202608:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20191031221353:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20191104164753:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20191217211338:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200103191258:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200103211543:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200109070519:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200205003215:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200205003400:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200507183648:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200604203226:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200609210443:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20200610220938:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201008203328:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201009194722:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201009195807:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201009202925:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201009211507:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201011114003:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201012151417:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201013123302:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201013184332:*:*:*:node.js:*:*
mit scratch-svg-renderer 0.2.0 cpe:2.3:a:mit:scratch-svg-renderer:0.2.0:prerelease20201014105708:*:*:*:node.js:*:*

References for CVE-2020-7750

cvelogic Threat Intelligence