Live › vulnerability › CVE-2026-121447
svg-sanitizer before 1.1.0 fails to strip javascript: URLs placed in the animateTransform values attribute, so a crafted SVG can smuggle script through the sanitizer. When a user clicks the resulting link in Safari, arbitrary JavaScript runs in the page's origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that use svg-sanitizer to clean user-uploaded SVG files and then display them to other users, especially on the same origin as the app. Apps that do not use the library, or that never render sanitized SVGs to browsers, are not exposed. Exploitation needs a victim who clicks the crafted link in Safari.
No product ranges from the sources yet.
npm ls svg-sanitizer or the lockfile.1.1.0 (fixed release per the description: all versions before 1.1.0 are affected).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.
This page as .md · .json · in your agent: get_signal("CVE-2026-121447")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.