Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121446— svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

Quick assessment

Affected
darylldoyle svg-sanitizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

svg-sanitizer 在 0.5.0 至 1.1.0 之前的版本中存在一个过滤不完整的漏洞，攻击者可通过在 SVG 的呈现属性中的 url() 内使用 CSS 转义序列来绕过远程 URL 的移除机制。攻击者可构造包含转义斜杠的 SVG 文件（例如在 fill 属性中），浏览器在解析时会将其还原为远程 URL，从而触发外部请求并导致数据泄露。

CVSS 4.3 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
darylldoyle svg-sanitizer 0.5.0< 1.1.0 affected
1.1.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121446

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
Source: CVE Program / CVE List V5
Vulnerability Description
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特殊元素过滤不完全
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
darylldoyle svg-sanitizer 0.5.0 ~ 1.1.0 -

II. Public POCs for CVE-2026-121446

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121446

请登录查看更多情报信息。

Other References for CVE-2026-121446 (2)

Same Patch Batch · darylldoyle · 2026-11-03 · 5 CVEs total

CVE-2026-121444 7.5 HIGH svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
CVE-2026-121447 6.1 MEDIUM svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
CVE-2026-121445 5.9 MEDIUM svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping
CVE-2026-121443 5.3 MEDIUM svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

IV. Related Vulnerabilities

Same product: svg-sanitizer
Same vendor: darylldoyle
Same weakness: CWE-791