Medium severityNVD Advisory· Published Sep 30, 2026· Updated Sep 30, 2026
CVE-2026-94545
CVE-2026-94545
Description
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
satorinpm | >= 0.0.27, < 0.33.5 | 0.33.5 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-wx4j-mvgx-mqwpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-94545ghsaADVISORY
- github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838envdWEB
- github.com/vercel/next.js/releases/tag/v16.3.6nvdWEB
- github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5jnvdWEB
- github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782nvdWEB
- github.com/vercel/satori/pull/814nvdWEB
- github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwpnvdWEB
News mentions
5- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- Node.js ImageResponse Implementation Vulnerability Enables Remote Code ExecutionCyber Security News · Oct 1, 2026
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More ThreatsThe Hacker News · Sep 28, 2026
- Critical NEXT.JS Flaw Enables RCE Attacks Via Weaponized SVG FileCyber Security News · Sep 23, 2026
- Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG InputThe Hacker News · Sep 23, 2026