Detections
Analytics

SCA: security update for satori (GHSA-wx4j-mvgx-mqwp)

medium Tenable Cloud Security Plugin ID 477620

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version
 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This
 can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is
 consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications
 that cannot immediately upgrade should not render attacker-controlled content with Satori.
 (CVE-2026-94545)

Solution

Update the satori library and its related packages to version 0.33.5 or later.

See Also

https://github.com/advisories/GHSA-wx4j-mvgx-mqwp

Plugin Details

Severity: Medium

ID: 477620

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-94545

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.3

Threat Score: 2.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 9/23/2026

Reference Information

CVE: CVE-2026-94545

cwe: CWE-116