EUVD-2026-115868

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that...