What’s Vulnerable › Vulnerabilities

CVE-2026-117539: darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-27
• Weakness: CWE-79

Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

Affected products

• darylldoyle svg-sanitizer: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: darylldoyle svg-sanitizer 1.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957
• https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass

Get alerted when CVE-2026-117539 or the next vulnerability affects your stack