Live › vulnerability › CVE-2026-94545
Go to dashboardSatori does not escape certain values before writing them into generated SVG, so attacker-supplied text can be read as SVG markup. The impact depends on how the resulting SVG is served or embedded, and the sources do not say whether it reaches script execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:47 UTC, 0h before NVD. All times on this page are UTC.
Applications that pass attacker-influenced strings into Satori and then serve or embed the generated SVG are exposed. Applications that render only fixed or trusted content, or that never accept user input into Satori, are less exposed. The advisory says no complete workaround exists besides upgrading.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| satori | npm | >= 0.0.27, < 0.33.5 | 0.33.5 |
npm ls satorisatori in package.json and lockfiles to find all dependentssatori to 0.33.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
This page as .md · .json · in your agent: get_signal("CVE-2026-94545")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.