Improper CSP in Image Optimization API for Next.js

Next.js versions 10.0.0 to 12.0.x have a weakness in their image optimization feature that allows attackers to bypass security protections (CSP) when SVG images are used. This could let malicious code execute in users' browsers if an image domain accepts user-uploaded SVGs.

A Content Security Policy (CSP) bypass exists in Next.js Image Optimization API when `images.domains` is configured with hosts that permit user-supplied SVG uploads and the default image loader is used. An attacker can craft malicious SVG content that circumvents CSP restrictions, potentially leading to cross-site scripting (XSS) attacks. Mitigation requires upgrading to version 12.1.0 or configuring a non-default `loader` in `next.config.js`.