CVE-2026-94545

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

CVSS

No CVSS.

References

Link	Resource
https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
https://github.com/vercel/next.js/releases/tag/v16.3.6
https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
https://github.com/vercel/satori/pull/814
https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp

Configurations

No configuration.

History

30 Sep 2026, 15:22

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-30 15:22

Updated : 2026-09-30 19:57

NVD link : CVE-2026-94545

Mitre link : CVE-2026-94545

CVE.ORG link : CVE-2026-94545

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-94545", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94545", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T15:41:03.767825Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vercel", "product": "satori", "versions": [{"status": "affected", "version": ">= 0.0.27, < 0.33.5"}]}, {"vendor": "vercel", "product": "next", "versions": [{"status": "affected", "version": ">= 16.2.0, < 16.3.6"}]}]}], "published": "2026-09-30T15:22:38.060", "references": [{"url": "https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e", "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/releases/tag/v16.3.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j", "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782", "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/satori/pull/814", "source": "security-advisories@github.com"}, {"url": "https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori."}], "lastModified": "2026-09-30T19:57:08.043", "sourceIdentifier": "security-advisories@github.com"}