CVE-2026-121446

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions 0.5.0 through 1.0.x

Description Incomplete filtering allows attackers to bypass the removal of remote URLs by utilizing CSS escape sequences within the url() function in SVG presentation attributes. By providing SVG files with attributes such as fill containing escaped slashes, browsers resolve these to remote URLs, which triggers external requests and enables data exfiltration.

Recommendations Update svg-sanitizer to version 1.1.0.