CVE-2026-94545CWE-116

CVE-2026-94545

published September 30, 2026

CVSS
5.3
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-09-30T19:22Z
References (6)
https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e · [email protected]https://github.com/vercel/next.js/releases/tag/v16.3.6 · [email protected]https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j · [email protected]https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782 · [email protected]https://github.com/vercel/satori/pull/814 · [email protected]https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp · [email protected]
EPSS history
Timeline
  • 02 OCT 03:47Z
    EPSS moved — → 1%
    epss
  • 30 SEP 14:53Z
    Satori-generated SVG has improper escaping
    cvelistv5