From aa272895d83ba56798d12ff16545c5f6eb2c6427 Mon Sep 17 00:00:00 2001
From: George Cushen <gcushen@users.noreply.github.com>
Date: Fri, 13 Mar 2026 13:49:30 +0000
Subject: [PATCH] fix: prevent double-unescaping in Icon SVG decoder (CWE-116)

Move \u0026 decode after HTML entity decodes so sequences like
\u0026lt; aren't double-unescaped into raw '<'.
---
 modules/blox/blox/shared/js/components/Icon.jsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/blox/blox/shared/js/components/Icon.jsx b/modules/blox/blox/shared/js/components/Icon.jsx
index 338f1e7d..45440abb 100644
--- a/modules/blox/blox/shared/js/components/Icon.jsx
+++ b/modules/blox/blox/shared/js/components/Icon.jsx
@@ -20,11 +20,11 @@ export const Icon = ({svg, attributes}) => {
   let decoded = String(svg)
     .replace(/\\u003c/gi, "<")
     .replace(/\\u003e/gi, ">")
-    .replace(/\\u0026/gi, "&")
     .replace(/&lt;/gi, "<")
     .replace(/&gt;/gi, ">")
     .replace(/&quot;/gi, '"')
     .replace(/&#34;/gi, '"')
+    .replace(/\\u0026/gi, "&")
     .replace(/&amp;/gi, "&")
     .trim();