Dashboard / CVE-2026-121447

CVE-2026-121447

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-03 Modified: 2026-11-09 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
darylldoyle svg-sanitizer 0 < 1.1.0
darylldoyle svg-sanitizer 0 < 1.1.0

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.17%
Raw Score 0.001710
Percentile 6.6%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00171
2026-11-13
0.00171
2026-11-12
0.00171
2026-11-10
0.00171
2026-11-09
0.00171
2026-11-08
0.00171
2026-11-07
0.00171
2026-11-06
0.00171
2026-11-05
0.00171
2026-11-04
0.00171

Intelligence Sources

mitre ref →
nvd ref →

External Links