CVE-2022-3355: 
Python vulnerability analysis and mitigation

Cross-site Scripting (XSS) - Stored vulnerability was discovered in GitHub repository inventree/inventree prior to version 0.8.3. The vulnerability was identified and tracked as CVE-2022-3355, with the disclosure date of September 29, 2022 (CVE Details).

The vulnerability was related to insufficient sanitization of SVG file attachments in the InvenTree system. The issue allowed for potential stored XSS attacks through SVG file uploads. The fix involved implementing proper SVG sanitization by adding a sanitizer function that cleanses SVG content before saving, using a whitelist of allowed elements and attributes (GitHub Commit).

The vulnerability could allow attackers to execute malicious scripts through stored SVG files in the system, potentially leading to unauthorized access to user data, session hijacking, or other client-side attacks typical of stored XSS vulnerabilities.

The issue was resolved in InvenTree version 0.8.3 through the implementation of SVG content sanitization. The fix includes a comprehensive sanitizer that validates and cleanses SVG files before they are stored in the system, using a predefined list of allowed elements and attributes (GitHub Commit).