Vulnerability record/PUBLISHED/Published Nov 3, 2026 14:28:36 UTC

CVE-2026-121447

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

Base score5.3/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionPassiveUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityLowVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedNov 9, 2026 15:36:34 UTC

PublishedNov 3, 2026 14:28:36 UTC

ReservedNov 3, 2026 12:33:53 UTC

Credits

prudloff-insite