CVE-2026-94545Satori-generated SVG has improper escaping
Updated under an hour ago ()
Does this affect you?
It affects vercel satori and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
- CVSS
- 5.3 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- Weakness (CWE)
- CWE-116
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
vercel satori vercel:satori (from the name) | from 0.0.27, < 0.33.5 | CNA record |
vercel next vercel:next (from the name) | from 16.2.0, < 16.3.6 | CNA record |
References
- https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwpx-refsource-confirm
- https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5jx-refsource-misc
- https://github.com/vercel/satori/pull/814x-refsource-misc
- https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838ex-refsource-misc
- https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782x-refsource-misc
- https://github.com/vercel/next.js/releases/tag/v16.3.6x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.