x/vulndb: potential Go vuln in github.com/turt2live/matrix-media-repo: GHSA-5crw-6j7v-xc72

[GoVulnBot]

In GitHub Security Advisory GHSA-5crw-6j7v-xc72, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/turt2live/matrix-media-repo	1.3.0	< 1.3.0

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/turt2live/matrix-media-repo
      versions:
        - fixed: 1.3.0
      vulnerable_at: 1.2.13
      packages:
        - package: github.com/turt2live/matrix-media-repo
summary: 'matrix-media-repo: Unsafe media served inline on download endpoints'
description: |-
    ### Impact A malicious user can upload an SVG image containing JavaScript to
    their server. When matrix-media-repo is asked to serve that media via the
    `/_matrix/media/(r0|v3)/download` endpoint, it would be served with a
    `Content-Disposition` of `inline`. This can allow JavaScript to run in the
    browser if a client links to the `/download` endpoint directly.

    Server operators which do not share a domain between matrix-media-repo and other
    services are not affected, but are encouraged to upgrade regardless.

    ### Patches
    https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137
    and
    https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
    fix the issue. Operators should upgrade to v1.3.0 as soon as possible.

    ### Workarounds The `Content-Disposition` header can be overridden by the
    reverse proxy in front of matrix-media-repo to always use `attachment`,
    defeating this issue at the cost of "worse" user experience when clicking
    download links.

    ### References https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script
cves:
    - CVE-2023-41318
ghsas:
    - GHSA-5crw-6j7v-xc72
references:
    - advisory: https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72
    - fix: https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137
    - fix: https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59
    - web: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script
    - advisory: https://github.com/advisories/GHSA-5crw-6j7v-xc72

[gopherbot]

Change https://go.dev/cl/527176 mentions this issue: data/excluded: batch add 14 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606791 mentions this issue: data/reports: unexclude 20 reports (11)