CVE-2026-121446: medium-severity vulnerability in darylldoyle svg-sanitizer
svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
darylldoyle · svg-sanitizerRelated CVEs — darylldoyle svg-sanitizer
In the same product, most dangerous first.
CVE-2022-23638MEDIUMCross-site Scripting in svg-sanitizerEPSS 0.7%CVE-2025-55166MEDIUMsvg-sanitizer By-Passing Attribute SanitizationEPSS 0.5%CVE-2026-107379MEDIUMenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-121444HIGHsvg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference GraphEPSS 0.4%CVE-2026-121445HIGHsvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingEPSS 0.4%