Medium severity · published Sep 30, 2026
CVE-2026-94545
Satori-generated SVG has improper escaping
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
next · vercel
>= 16.2.0, < 16.3.6 · source: vendor
SA
satori · vercel
>= 0.0.27, < 0.33.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94545
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94545
x_refsource_CONFIRM
https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
x_refsource_MISC
https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
x_refsource_MISC
https://github.com/vercel/satori/pull/814
x_refsource_MISC
https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
x_refsource_MISC
https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v16.3.6
More from next
7.5
CVE-2025-59472
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode
7.5
CVE-2025-59471
A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer