---
id: CVE-2026-121446
title: svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
summary: >-
  svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering
  vulnerability that allows attackers to bypass remote URL removal by using CSS
  escape sequences inside url() in SVG presentation attributes. Attackers can
  supply SVG f…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-791
vendor: darylldoyle
product: svg-sanitizer
affected:
  - svg-sanitizer >= 0.5.0 < 1.1.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:03:46.540150Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:04:07.902Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121446'
references:
  - url: >-
      https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w
    label: GitHub Security Advisory (GHSA-3vh3-jf65-656w)
  - url: >-
      https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes
    label: >-
      VulnCheck Advisory: svg-sanitizer 0.5.0 before 1.1.0 Incomplete url()
      Filtering in SVG Attributes
tags:
  - cve.org
  - exploit-available
epss: 0.00197
epssPercentile: 0.09466
ingestedAt: '2026-11-05T19:30:42.971Z'
---

## Overview

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

## Affected

- `svg-sanitizer >= 0.5.0 < 1.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.