Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121446svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

Medium 4.3

In plain English

A medium-severity security flaw in svg-sanitizer from darylldoyle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

Affected products (as reported)

Vendor	Product	Versions
darylldoyle	svg-sanitizer	0.5.0 – before 1.1.0

Weakness: CWE-791 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-3vh3-jf65-656w) vendor-advisory
VulnCheck Advisory: svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes third-party-advisory