SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain…

Description

SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.

Scores

EPSS (exploitation in 30 days)

0.58% · top 52% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• Script could be executed via svg's use element
• CWE-116 Improper Encoding or Escaping of Output (opens in a new tab)All about CWE-116 and its CVEs

Affected products

• Mozilla · Firefox

  • affected unspecified – < 99

References (2)

• https://www.mozilla.org/security/advisories/mfsa2022-13/ (opens in a new tab)x_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=1754522 (opens in a new tab)x_transferredexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-28284](https://trackcve.app/badge/CVE-2022-28284.svg)](https://trackcve.app/cve/CVE-2022-28284)

Record last updated 16 Apr 2025, 14:06 UTC.