PT-2026-136204

CVE-2026-121447

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions svg-sanitizer versions prior to 1.1.0

Description An issue exists where sanitization can be bypassed by placing javascript: URLs within the values attribute of the animateTransform element. This allows attackers to upload crafted SVG files that target the href attribute, leading to the execution of arbitrary JavaScript when a user of the Safari browser clicks the link. Cross-site scripting (XSS) is a technique where malicious scripts are injected into otherwise trusted websites.

Recommendations Update to version 1.1.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Prudloff-Insite

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers