CVE-2026-117539: darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using darylldoyle svg-sanitizer versions before 1.0.0 are exposed when they accept attacker-controlled SVG uploads and later render or serve those SVGs to users.
What does an attacker need to exploit it?
An attacker needs permission to upload or otherwise supply a crafted SVG file, and a victim must view or render that SVG. The crafted file can use unsanitized style content, unquoted url() values, or image href attributes to load external resources.
What can exploitation enable?
External resource loading can be used to track viewers, disclose visitor IP addresses, or exfiltrate page data. The reported impact is limited to confidentiality; no integrity or availability impact is specified.
Which version resolves the issue?
The issue affects versions before 1.0.0. Upgrade to version 1.0.0 or later.