CVE-2017-17215

CVE-2017-17215 Usage: CVE-2017-12149.py http://targetip:37215/ I am so poor that cant afford to but a HUAWEI router XD so it is not tested on any machine but the exp technically should be working I found this report...

CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection GHSA-vcvr-r3jv-pc5j Security-research material for reproducing and validating CVE-2026-94545 , the Next.js ImageResponse SVG-serialization injection upstream: Satori GHSA-wx4j-mvgx-mqwp, in an isolated, loopback-only lab. Affected:...

EUVD-2026-89994

Satori-generated SVG has improper escaping...

GHSA-WX4J-MVGX-MQWP Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

@a11ywatch/web (>=0.5.5, <=0.5.212), @abtnode/blocklet-services (>=1.16.15-beta-103b95c0, <=1.17.13-beta-20261020-042751-541e5c03) +606 more potentially affected by CVE-2026-94545 via satori (>=0.0.27, <=0.33.4)

satori NPM version =0.0.27, =0.5.5, =1.16.15-beta-103b95c0, =1.16.15-beta-103b95c0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.203, =0.1.0, =1.0.1, =1.0.1, =1.0.20, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.5 and more Source cves: CVE-2026-94545 Source advisory:...

npm: Satori-generated SVG has improper escaping

npm: Satori-generated SVG has improper escaping vulnerability discovered by ? in WordPress npm satori versions = 0.0.27, 0.33.5...

Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

@a11ywatch/web (>=0.5.5, <=0.5.212), @abtnode/blocklet-services (>=1.16.15-beta-103b95c0, <=1.17.13-beta-20261020-042751-541e5c03) +606 more potentially affected by CVE-2026-94545 via satori (>=0.0.27, <=0.33.4)

satori NPM version =0.0.27, =0.5.5, =1.16.15-beta-103b95c0, =1.16.15-beta-103b95c0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.203, =0.1.0, =1.0.1, =1.0.1, =1.0.20, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.5 and more Source cves: CVE-2026-94545 Source advisory: GHSA-WX4J-MVGX-MQ...

Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE

The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability. Satori does not properly escape certain values before including them in generated SVG output, whi...

CVE-2026-94545

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

Exploit for CVE-2026-94545

CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...

CVE-2026-94545 Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

CVE-2026-94545

The Satori library (used by Next.js to convert HTML/CSS to SVG) fails to properly escape certain values, such as the ; character, before including them in generated SVG output. This improper output encoding (CWE-116) allows crafted values to be interpreted as SVG markup. When Next.js (versions 16...

@a11ywatch/web (>=0.5.5, <=0.5.212), @abtnode/blocklet-services (>=1.16.15-beta-103b95c0, <=1.17.13-beta-20261020-042751-541e5c03) +606 more potentially affected by CVE-2026-94545 via satori (>=0.0.27, <=0.33.4)

satori NPM version =0.0.27, =0.5.5, =1.16.15-beta-103b95c0, =1.16.15-beta-103b95c0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.203, =0.1.0, =1.0.1, =1.0.1, =1.0.20, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.5 and more Source cves: CVE-2026-94545 Source advisory: MEND:CVE-2026-945...

CVE-2026-94545 Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

CVE-2026-94545

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

@a11ywatch/web (>=0.5.5, <=0.5.212), @abtnode/blocklet-services (>=1.16.15-beta-103b95c0, <=1.17.13-beta-20261020-042751-541e5c03) +606 more potentially affected by CVE-2026-94545 via satori (>=0.0.27, <=0.33.4)

satori NPM version =0.0.27, =0.5.5, =1.16.15-beta-103b95c0, =1.16.15-beta-103b95c0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.203, =0.1.0, =1.0.1, =1.0.1, =1.0.20, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.5 and more Source cves: CVE-2026-94545 Source advisory:...

Improper Encoding or Escaping of Output

Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...

Exploit for CVE-2026-94545

CVE-2026-94545: Next.js next/og allows unauthorized remote c...

CVE-2026-94545: Improper Encoding or Escaping of Output

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...