Vendor
VvvebJs versions 2.0.5 and earlier are vulnerable to stored cross-site scripting due to improper sanitization of uploaded SVG files containing embedded JavaScript.