Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121447svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
Medium 6.1
In plain English
A medium-severity cross-site scripting in svg-sanitizer from darylldoyle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 93.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| darylldoyle | svg-sanitizer | 0 – before 1.1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-q546-85r6-f39q) vendor-advisory
- VulnCheck Advisory: svg-sanitizer before 1.1.0 XSS via animateTransform on Safari third-party-advisory