CVE-2026-117539

medium

Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

References

https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110804

Details

Source: Mitre, NVD

Published: 2026-10-27

Updated: 2026-10-27

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 3.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Severity: Low

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium