Live › vulnerability › CVE-2026-121446
svg-sanitizer versions from 0.5.0 before 1.1.0 fail to remove remote url() references written with CSS escape sequences in SVG presentation attributes such as fill. A crafted SVG passes the filter, and when a browser renders it the file makes external requests that can leak data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that use svg-sanitizer to clean user-uploaded SVG files and then serve or render them in a browser are exposed. Projects that do not use this library, or that never accept untrusted SVG, can skip it.
No product ranges from the sources yet.
npm ls svg-sanitizer or by reading its package.json.1.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
This page as .md · .json · in your agent: get_signal("CVE-2026-121446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.