XSS in Image Optimization API for Next.js

2021-09-0118:24:22

Google

osv.dev

260

xss

image optimization

next.js

version 10.0.0-11.1.0

next.config.js

images.domains

svg

vercel

patch v11.1.1

security issue

user input

EPSS

0.001

Percentile

29.3%

Affected: All of the following must be true to be affected
- Next.js between version 10.0.0 and 11.1.0
- The next.config.js file has images.domains array assigned
- The image host assigned in images.domains allows user-provided SVG
Not affected: The next.config.js file has images.loader assigned to something other than default
Not affected: Deployments on Vercel are not affected