CVE-2026-121446

4.3 MEDIUMpublic exploit available

Published 2026-11-03 · Updated 2026-11-03

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses

CWE-791

Public exploit & PoC references

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w

All references

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w
https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-102771PoC
MEDIUMCVE-2026-103540PoC
MEDIUMCVE-2026-108570

Related by shared AI tags and CWE weakness class. Browse the full archive.