Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 22:48:35 +0000 CVE-2026-121446 — svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes https://db.gcve.eu/vuln/cve-2026-121446 <p><strong>Affected:</strong> darylldoyle svg-sanitizer</p> <p>svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.</p> <p><strong>Affected:</strong> darylldoyle svg-sanitizer</p> <p>svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.</p> https://db.gcve.eu/vuln/cve-2026-121446