Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-117539darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
Low 3.5
In plain English
A low-severity cross-site scripting in svg-sanitizer from darylldoyle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| darylldoyle | svg-sanitizer | 0 – before 1.0.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-qhmf-972w-m957) vendor-advisory
- VulnCheck Advisory: darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass third-party-advisory