← Database

CVE-2026-121447

MEDIUM CVSS: 6.1 Published: 2026-11-03 Modified: 2026-11-03

Description

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

Affected Platforms

Unknown

Weakness Type

CWE-79

References