---
id: "CVE-2026-121446"
kind: "vulnerability"
aliases: ["CVE-2026-121446"]
title: "svg-sanitizer: CSS escapes let SVG files fetch remote URLs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "package", "svg-sanitizer", "user-uploads"]
not_affected_if: ["no-untrusted-svg", "not-using-svg-sanitizer"]
published_at: "2026-11-03T15:17:36+00:00"
first_seen_at: "2026-11-03T15:22:01+00:00"
updated_at: "2026-11-03T15:23:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121446", "first_seen_at": "2026-11-03T15:22:01+00:00"}]
---

# svg-sanitizer: CSS escapes let SVG files fetch remote URLs

svg-sanitizer versions from 0.5.0 before 1.1.0 fail to remove remote url() references written with CSS escape sequences in SVG presentation attributes such as fill. A crafted SVG passes the filter, and when a browser renders it the file makes external requests that can leak data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of svg-sanitizer in your project, for example with `npm ls svg-sanitizer` or by reading its package.json.
- Look for any code path that passes user-supplied SVG through svg-sanitizer before serving or rendering it.

## Fix

- svg-sanitizer: move to `1.1.0` or later

## Timeline

- 2026-11-03T15:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121446

## Documents

- [advisory] Vendor advisory: github.com https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes

## From the sources

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_