Low severity · published Oct 27, 2026
CVE-2026-117539
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
New
3.5
CVSS
–
EPSS
No
On KEV
Description
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
svg-sanitizer · darylldoyle
before 1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117539
github.com
https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957
www.vulncheck.com
https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass
More from svg-sanitizer
7.5
CVE-2026-117540
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
6.5
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
5.3
CVE-2026-117541
svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()