---
id: CVE-2026-117539
title: >-
  darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference
  Bypass
summary: >-
  darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote
  reference bypass vulnerabilities that allow attackers to embed external
  resources by uploading crafted SVG files. Attackers can use unsanitized style
  content, unquo…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: darylldoyle
product: svg-sanitizer
affected:
  - svg-sanitizer < 1.0.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T10:59:33.466Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117539'
references:
  - url: >-
      https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957
    label: GitHub Security Advisory (GHSA-qhmf-972w-m957)
  - url: >-
      https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass
    label: >-
      VulnCheck Advisory: darylldoyle svg-sanitizer before 1.0.0 CSS Injection
      and Remote Reference Bypass
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.298Z'
---

## Overview

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

## Affected

- `svg-sanitizer < 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.