{"id":"CVE-2026-94545","kind":"vulnerability","aliases":["CVE-2026-94545","GHSA-wx4j-mvgx-mqwp"],"related":[],"title":"Satori-generated SVG has improper escaping","description":"Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.","summary":"Satori does not escape certain values before writing them into generated SVG, so attacker-supplied text can be read as SVG markup. The impact depends on how the resulting SVG is served or embedded, and the sources do not say whether it reaches script execution.","severity":"medium","cvss":5.3,"epss":0.01082,"exploited":false,"exploited_at":null,"products":[{"name":"satori","fixed":["0.33.5"],"affected":">= 0.0.27, < 0.33.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-116","next.js","node","npm","open-graph-images","package"],"not_affected_if":["no-user-input-rendered","static-content-only"],"how_to_check":"- Check the installed version with `npm ls satori`\n- Look for `satori` in `package.json` and lockfiles to find all dependents\n- Find routes or jobs that pass user-controlled text into Satori for rendering, such as OG image generators","fix":"- Upgrade `satori` to `0.33.5` or later\n- Until upgraded, do not render attacker-controlled content with Satori, per the advisory","status":"open","published_at":"2026-09-30T15:22:38+00:00","first_seen_at":"2026-10-27T14:47:34+00:00","triaged_at":"2026-10-27T14:49:39+00:00","updated_at":"2026-10-27T15:02:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:49:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `satori` to `0.33.5` or later\n- Until upgraded, do not render attacker-controlled content with Satori, per the advisory","reach":"internet","title":"Satori: SVG output escaping flaw lets crafted text inject markup","impact":"medium","summary":"Satori does not escape certain values before writing them into generated SVG, so attacker-supplied text can be read as SVG markup. The impact depends on how the resulting SVG is served or embedded, and the sources do not say whether it reaches script execution.","category":"package","nicknames":[],"who_cares":["next.js","node","open-graph-images","npm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"crafted text is interpreted as SVG markup in generated output","analyst_note":"Check GHSA-wx4j-mvgx-mqwp for the concrete injection vector and whether script execution is possible in browsers.","how_to_check":"- Check the installed version with `npm ls satori`\n- Look for `satori` in `package.json` and lockfiles to find all dependents\n- Find routes or jobs that pass user-controlled text into Satori for rendering, such as OG image generators","needs_analyst":true,"not_affected_if":["no-user-input-rendered","static-content-only"],"who_is_affected":"Applications that pass attacker-influenced strings into Satori and then serve or embed the generated SVG are exposed. Applications that render only fixed or trusted content, or that never accept user input into Satori, are less exposed. The advisory says no complete workaround exists besides upgrading.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":3372,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116':21B '-2026':9A,17A '-94545':10A,18A '0.0.27':90C '0.33.5':95C,132C 'allow':112C 'applic':142C 'attack':44B,151C 'attacker-control':150C 'attacker-suppli':43B 'besid':140C 'cannot':144C 'certain':34B,101C 'complet':137C 'consum':130C 'contain':133C 'content':153C 'control':152C 'convert':81C 'craft':113C 'css':84C 'cve':8A,16A 'cwe':20B 'depend':55B,123C 'embed':64B 'escap':7A,33B,100C 'execut':75B 'exist':139C 'generat':3A,40B,107C,127C 'ghsa':12A 'ghsa-wx4j-mvgx-mqwp':11A 'graph':27B 'html':82C 'imag':28B 'immedi':145C 'impact':54B,122C 'improp':6A 'includ':104C 'interpret':117C 'librari':79C 'markup':52B,120C 'mqwp':15A 'mvgx':14A 'next.js':22B 'node':23B 'npm':24B 'open':26B 'open-graph-imag':25B 'output':109C 'packag':29B 'patch':135C 'prior':92C 'proper':99C 'reach':73B 'read':49B 'render':149C 'result':59B 'satori':2A,19A,30B,76C,96C,155C 'satori-gener':1A 'say':70B 'script':74B 'serv':62B 'sourc':67B 'start':87C 'suppli':45B 'svg':4A,41B,51B,60B,86C,108C,119C,128C 'text':46B 'upgrad':141C,146C 'valu':35B,102C,114C 'version':89C,94C,131C 'whether':71B 'workaround':138C 'write':37B 'wx4j':13A","nicknames":[],"mitigations":[],"who_affected":"Applications that pass attacker-influenced strings into Satori and then serve or embed the generated SVG are exposed. Applications that render only fixed or trusted content, or that never accept user input into Satori, are less exposed. The advisory says no complete workaround exists besides upgrading.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T15:22:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wx4j-mvgx-mqwp","url":"https://github.com/advisories/GHSA-wx4j-mvgx-mqwp","severity":"medium","published_at":"2026-10-27T14:46:43+00:00","modified_at":"2026-10-27T14:46:44+00:00","first_seen_at":"2026-10-27T14:47:34+00:00","fetched_at":"2026-10-27T14:47:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94545","severity":null,"published_at":"2026-09-30T15:22:38+00:00","modified_at":"2026-09-30T19:57:08+00:00","first_seen_at":"2026-10-27T15:02:22+00:00","fetched_at":"2026-10-27T15:02:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}