CVE-2026-94545 Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

CVE-2026-94545

The Satori library (used by Next.js to convert HTML/CSS to SVG) fails to properly escape certain values, such as the ; character, before including them in generated SVG output. This improper output encoding (CWE-116) allows crafted values to be interpreted as SVG markup. When Next.js (versions 16...

Next.js: Remote Code Execution in next/og ImageResponse

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

GHSA-VCVR-R3JV-PC5J Next.js: Remote Code Execution in next/og ImageResponse

Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...

Improper Encoding or Escaping of Output

Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...

CVE-2026-94672

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94077

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-94672 WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94672 WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

EUVD-2026-89846

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94672

The Safe SVG WordPress plugin (versions

CVE-2026-94077 WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-94077 WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-94077

The Safe SVG WordPress plugin, versions

EUVD-2026-89832

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-75098

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2025-14564

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

Lab-Reflected-XSS-with-some-SVG-markup-allowed-PRACTITIONER-LAB-Not-solved

Lab: Reflected XSS with some SVG markup allowed 📚 Studijní...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2025-14564 Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...