Dashboard / CVE-2026-121446

CVE-2026-121446

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-03 Modified: 2026-11-07 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: None
VA: None

Description

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
darylldoyle svg-sanitizer 0.5.0 < 1.1.0
darylldoyle svg-sanitizer 0.5.0 < 1.1.0

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.20%
Raw Score 0.001970
Percentile 9.5%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00197
2026-11-13
0.00197
2026-11-12
0.00197
2026-11-10
0.00197
2026-11-09
0.00197
2026-11-08
0.00197
2026-11-07
0.00197
2026-11-06
0.00197
2026-11-05
0.00197
2026-11-04
0.00197

Intelligence Sources

mitre ref →
nvd ref →

External Links