Input validation error in SVG Sanitizer - #VU159653
Published: November 6, 2026
Vulnerability identifier: #VU159653
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to trigger requests to attacker-controlled external resources through a sanitized SVG.
The vulnerability exists due to incomplete filtering of CSS-escaped URLs in SVG Sanitizer when processing url() values in presentation attributes such as fill. An unauthenticated remote attacker can supply an SVG containing an escaped external URL that survives sanitization and triggers an outbound request when a victim opens it in Chrome.
Affected software
SVG Sanitizer
Remediation
Install security update from vendor's website.
SVG Sanitizer - update to 1.1.0