CVE-2026-121447

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

CVE-2026-121447 svg-sanitizer before 1.1.0 XSS via animateTransform on Safari

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

CVE-2026-121447

The svg-sanitizer library versions prior to 1.1.0 is vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is a sanitization bypass where attackers can embed javascript: URLs within the animateTransform values attribute. By uploading a crafted SVG file, an attacker can target the href a...

EUVD-2026-115869

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

CVE-2026-121447: darylldoyle svg-sanitizer: svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization…

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary...

SUSE CVE-2010-1402

Double free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to an event listener in an SVG document,...

XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

RUSTSEC-2021-0158 XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS. The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute...

CVE-2010-1402

Double free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to an event listener in an SVG document,...