Incomplete Filtering Vulnerability in svg-sanitizer by Daryl Doyle

CVE-2026-121446

What is CVE-2026-121446?

The svg-sanitizer tool, versions 0.5.0 through 1.1.0, contains an incomplete filtering vulnerability that permits attackers to bypass the intended restrictions on remote URLs. By leveraging CSS escape sequences within the url() function in SVG presentation attributes, malicious actors can craft SVG files with innocuous-looking attributes that resolve to remote URLs. This leads to unintended external requests being generated, potentially resulting in data exfiltration from the affected system. It's crucial for users of svg-sanitizer to update to version 1.1.0 or later to mitigate this risk.

References