Researchers chain Cloudflare image flaws into a CSP-bypass XSS
Original title: Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript
A public write-up shows script execution via /cdn-cgi/image/ using an SVG namespace bug and a Chromium cache quirk.
Searchlight Cyber researchers Kevin Gervot and Adam Kues reported on October 28, 2026, that weaknesses in Cloudflare Image Transformations can be chained to run JavaScript on cloudflare.com despite a strict content security policy. The chain uses an xml-rs namespace escaping gap in svg-hush, Cache-Control behavior followed by Chromium, and redirects, including Cloudflare Access logout, to fetch an attacker-controlled image. The write-up lists no CVE or patch status. They also describe related cache and header issues on Netlify, Amazon S3, and Google Cloud Storage.
Unconfirmed: No CVE or patch status is given, and the researchers could not confirm Netlify's hosted code matches its open-source version.
- Cloudflare adds a managed /cdn-cgi/ path on a customer's own domain.
- svg-hush writes xmlns values raw after xml-rs has already approved the file.
- Only Chromium honors no-cache="Content-Security-Policy", and only after a reload from disk cache.
- The Access logout returnTo setting accepts any cloudflare.com subdomain.
Impact: JavaScript execution in the trusted site origin
| Product | Affected |
|---|---|
| Cloudflare Image Transformations | — |
- 1.Avoid forwarding Cache-Control and X-* headers from untrusted image sources.
- 2.Set X-Content-Type-Options: nosniff and review which sources image tools may fetch.
- 3.Close open redirects that an image fetcher could follow.
- ATT&CK
- T1059.007 JavaScript
- Organizations
- Searchlight Cyber
From the original article
3 min read at cybersecuritynews.com
Security researchers at Searchlight Cyber chained several small weaknesses in Cloudflare’s image feature. The chain let them run JavaScript on a site that was meant to block it. Kevin Gervot and Adam Kues published the work on October 28, 2026, in a write-up titled Cache Me If You Can.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.