CVE-2026-117539

darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass

State: Published
Severity: 5.1 Medium
Published: Oct 27, 2026
Updated: Oct 27, 2026
Reserved: Oct 27, 2026

Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
svg-sanitizerdarylldoyle	before 1.0.0Affected 1.0.0Not affected

References

GitHub Security Advisory (GHSA-qhmf-972w-m957)vendor-advisory
VulnCheck Advisory: darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypassthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.