Satori-generated SVG has improper escaping
35Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.8%
da publicação à arma0 dias
Publicada no NVD30 de set.
1ª PoC23 de set.
probabilidade de exploração
0.8%top 45% das CVEs
exploração observada
nãonenhuma fonte reporta
5 exploit(s) público(s)
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
PoCs públicas encontradas — 5
githubgithub.com/EQSTLab/CVE-2026-94545★ 43githubgithub.com/HORKimhab/CVE-2026-94545★ 1githubgithub.com/Hassham1/CVE-2026-94545-nextjs-og-poc★ 1githubgithub.com/mhtsec/CVE-2026-94545★ 1githubgithub.com/MRdark-ops/CVE-2026-94545-★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838ehttps://github.com/vercel/next.js/releases/tag/v16.3.6https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5jhttps://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782https://github.com/vercel/satori/pull/814https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp