Live › vulnerability › CVE-2026-117539
Go to dashboardThe svg-sanitizer npm library before 1.0.0 fails to strip some CSS and remote href references from SVG files. An attacker who gets a crafted SVG processed by the library can make it load external resources, exfiltrate page data, track users, or reveal visitor IP addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Applications that accept user-uploaded SVG files and sanitize them with svg-sanitizer before the 1.0.0 release are exposed, since the flaw is in how the library cleans CSS and href values. Systems that do not use this package, or that never render user-supplied SVG, can skip it.
No product ranges from the sources yet.
npm ls svg-sanitizer or by reading node_modules/svg-sanitizer/package.json.svg-sanitizer to find where uploaded SVGs are passed through it.1.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
This page as .md · .json · in your agent: get_signal("CVE-2026-117539")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.