CVE-2026-94545: Satori-generated SVG has improper escaping
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Satorito a version that resolves this vulnerability.Fixed in 0.33.5 - Compensating control
Until upgrading, do not render attacker-controlled content with Satori.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using npm/satori versions 0.0.27 through versions before 0.33.5 are affected when they generate SVG from values that may be attacker-controlled. The practical impact depends on how the generated SVG is subsequently consumed.
What does an attacker need to exploit this issue?
An attacker needs a way to supply crafted values that Satori includes in generated SVG output. Those values may then be interpreted as SVG markup because certain values are not properly escaped.
What should teams do if they cannot upgrade immediately?
There is no complete workaround other than upgrading to version 0.33.5. Until an upgrade is possible, applications should not render attacker-controlled content with Satori.