CVE-2026-121447
Deferred Deferred - Pending Action

XSS in svg-sanitizer via javascript: URLs in animateTransform

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121447
EUVD
EUVD-2026-115869

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
darylldoyle svg-sanitizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

svg-sanitizer before 1.1.0 has a cross-site scripting flaw where attackers can bypass sanitization by inserting javascript: URLs in the animateTransform values attribute of SVG files. This allows execution of arbitrary JavaScript when users click the link, particularly affecting Safari users.

Impact Analysis

If you use svg-sanitizer before 1.1.0, attackers could upload malicious SVG files to your system. When users interact with these files in Safari, the JavaScript executes, potentially stealing data, session cookies, or performing actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Upgrade svg-sanitizer to version 1.1.0 or later to address the XSS vulnerability in animateTransform values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...