CVE-2026-121447: darylldoyle svg-sanitizer, XSS

Описание

Оригинално описание

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

Засегнати продукти

• darylldoyle svg-sanitizer: преди 1.1.0; 1.1.0

Вид слабост

• CWE-79 XSS

История

Други уязвимости в darylldoyle svg-sanitizer

• 5.3CVE-2026-121446
• 8.2CVE-2026-121445
• 8.7CVE-2026-121444
• 6.9CVE-2026-121443
• 8.7CVE-2026-117540

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-121447
• https://nvd.nist.gov/vuln/detail/CVE-2026-121447
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-q546-85r6-f39q
• https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-xss-via-animatetransform-on-safari