CVE-2026-117539 Details
Description
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
A vulnerability in darylldoyle svg-sanitizer versions prior to 1.0.0 allows for CSS injection and remote reference bypass. This issue arises from improper sanitization of SVG files, enabling attackers to embed external resources. Exploitation can be achieved by uploading specially crafted SVG files that exploit unsanitized style content, unquoted url() values, or image href attributes. The consequences of this vulnerability include exfiltration of page data, user tracking, and disclosure of visitor IP addresses.
Users are advised to update to darylldoyle svg-sanitizer version 1.0.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| darylldoyle svg-sanitizer | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |