CVE-2020-7750: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-7750 affects the scratch-svg-renderer package versions before 0.2.0-prerelease.20201019174008. The issue was discovered and assigned on January 21, 2020, involving improper SVG string handling that could potentially lead to DOM manipulation (CVE Details).

The vulnerability exists in the loadString function of the scratch-svg-renderer package, which fails to properly escape SVG content. This can be exploited through the _transformMeasurements function to inject arbitrary elements into the DOM (CVE Details, GitHub Commit).

The vulnerability could allow attackers to inject arbitrary elements into the DOM, potentially leading to Cross-Site Scripting (XSS) attacks in applications using the affected package (CVE Details).

The vulnerability can be exploited through the manipulation of SVG strings passed to the loadString function, which are then processed by the _transformMeasurements function without proper sanitization (GitHub Commit).

The issue has been fixed in version 0.2.0-prerelease.20201019174008 and later. The fix includes the implementation of DOMPurify sanitization for SVG content before processing, specifically using SVG profiles and forbidding certain tags like 'a', 'audio', 'canvas', and 'video' (GitHub Commit).