AIKIDO-2025-10497

TL;DR

Affected versions of this package are vulnerable to SVG parsing XSS, where image loader insecurely processes SVG content, failing to sanitize non-SVG elements like <link> or <img> during parsing. It allows attackers to craft malicious SVG images containing embedded scripts or external resource tags that execute when loaded via Babylon.js GUI.Image component. Exploitation occurs when a vulnerable application (without proper Content Security Policies) renders user-supplied SVG files, enabling cross-site scripting (XSS) attacks that hijack user sessions, steal data, or perform malicious actions within the application context.