Plunk Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in Plunk, an open-source email platform that utilizes AWS SES. In versions prior to 0.7.1, the image upload endpoint allowed SVG files, which can execute embedded JavaScript, creating a risk of cross-site scripting. This issue has been addressed in version 0.7.1 by removing SVG from the list of permitted file types and implementing magic-byte validation to ensure uploaded files match their claimed image format.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files could execute JavaScript in the context of the user.

Remediation

Users can upgrade to Plunk version 0.7.1 or later to address this vulnerability.