GHSA-cf4q-4cqr-7g7w: 
Python vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-cf4q-4cqr-7g7w) was identified in xml2rfc affecting versions prior to 3.12.4. The vulnerability was discovered and published on April 12, 2022, with the latest update on January 11, 2023. The issue allows script elements in SVG sources which can lead to cross-site scripting (XSS) attacks in HTML output (GitHub Advisory).

The vulnerability stems from xml2rfc's handling of SVG elements, specifically allowing script elements within SVG sources to be processed and included in HTML output. This creates a potential vector for cross-site scripting attacks. The vulnerability has been classified with CWE-79 (Cross-site Scripting) and received a moderate severity rating (GitHub Advisory).

The vulnerability primarily affects websites that publish HTML drafts and RFCs using xml2rfc. When exploited, it could allow attackers to execute malicious scripts through SVG elements, potentially compromising the security of affected websites (GitHub Advisory).

The vulnerability has been patched in version 3.12.4 of xml2rfc. For users unable to update immediately, a workaround involves scraping script elements from SVG files if the SVG source is self-contained within the XML (GitHub Advisory).