Low severity3.5NVD Advisory· Published Oct 27, 2026· Updated Oct 27, 2026

CVE-2026-117539

Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

Affected products

Dar/Svg Sanitizerllm-create
Range: <1.0.0

Patches

Vulnerability mechanics

References

github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957nvd
www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000