CVE-2026-94545

Satori, the open-source library that converts HTML and CSS into SVG and powers Next.js's ImageResponse/@vercel/og image generation, fails to escape certain values before embedding them in its SVG output (CWE-116). An attacker who can get crafted content (e.g., user-controlled text, titles, or query parameters) rendered through a Satori-based endpoint can inject arbitrary SVG markup into the generated image. The impact depends on how the SVG is consumed downstream: the CVSS vector (SC:H/SI:H with UI:P) indicates high impact on subsequent systems, and public reports demonstrate cross-site scripting and, in some server-side rendering configurations, code execution. All applications using Satori from 0.0.27 up to (but not including) 0.33.5 are affected, with 0.33.5 containing the patch; the vendor states no complete workaround exists besides upgrading and warns against rendering attacker-controlled content until patched. Four public proof-of-concept repositories exist, the flaw is not yet in CISA's KEV catalog, and no confirmed in-the-wild exploitation has been reported.

What to do: Upgrade Satori to 0.33.5 or later immediately; Next.js users should update to a build that pulls the patched Satori and verify with 'npm ls satori' (or the equivalent in pnpm/yarn/lockfile inspection). Until patched, do not render attacker-controlled content (query parameters, usernames, post titles, free-text fields) through Satori or ImageResponse endpoints — restrict OG image inputs to trusted or strictly allowlisted values. Also review how generated SVGs are consumed downstream and disable script/markup execution in any server-side SVG rasterizer or renderer processing them.