CVE-2026-94545
Received Received - Intake

Heap-based Buffer Overflow in Satori HTML-to-SVG Library

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-94545
EUVD
EUVD-2026-89994

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vercel satori From 0.0.27 (inc) to 0.33.5 (exc)
vercel next.js From 16.2.0 (inc) to 16.3.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94545 affects the Satori library, which converts HTML and CSS to SVG. Versions 0.0.27 to 0.33.4 improperly escape certain values in generated SVG output, allowing crafted inputs to be interpreted as SVG markup. This could lead to unintended markup execution if attacker-controlled content is rendered.

Impact Analysis

The impact depends on how the generated SVG is consumed. If attacker-controlled content is rendered with Satori, it could lead to unintended markup execution. This might affect subsequent systems processing the SVG, potentially compromising confidentiality and integrity. No direct impact on the vulnerable system itself is noted.

Mitigation Strategies

Upgrade Satori to version 0.33.5 or later. If upgrading is not possible, avoid rendering attacker-controlled content with Satori.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart