CVE-2026-117539— darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass

Quick assessment

Affected

darylldoyle svg-sanitizer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

darylldoyle 开发的 svg-sanitizer 在 1.0.0 版本之前存在 CSS 注入和远程引用绕过漏洞。攻击者可通过上传特制的 SVG 文件嵌入外部资源。利用未过滤的样式内容、未加引号的 url() 值或图像的 href 属性，攻击者能够窃取页面数据、追踪用户或泄露访客的 IP 地址。

CVSS 3.5 · Low Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1070 · Indicator Removal T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
darylldoyle	svg-sanitizer	0 ~ 1.0.0	-

II. Public POCs for CVE-2026-117539

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117539

请登录查看更多情报信息。

Other References for CVE-2026-117539 (2)

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957 vendor-advisory
https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117539

Same Patch Batch · darylldoyle · 2026-10-27 · 3 CVEs total

CVE-2026-117540	7.5 HIGH	svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
CVE-2026-117541	5.3 MEDIUM	svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

IV. Related Vulnerabilities

Same product: svg-sanitizer

Same vendor: darylldoyle

Same weakness: CWE-79