Cloudflare Image Transformations chain bypasses CSP for XSS
Original title: Cloudflare Image Transformation Flaw Allows Hackers to Bypass CSP and Execute Malicious JavaScript
Researchers combined an SVG sanitizer bug, Chromium cache behavior, and redirects; no CVE or wild exploitation is confirmed.
Kevin Gervot and Adam Kues published an October 28, 2026 analysis of Cloudflare’s /cdn-cgi/image/ endpoint. An XML serialization flaw in svg-hush and xml-rs can inject script after sanitization, while a Chromium cache interaction can drop a forwarded Content-Security-Policy header. Redirects, including a Cloudflare Access logout path in some setups, can fetch an attacker-hosted image. They demonstrated XSS on Cloudflare’s website; exploitation depends on configuration and browser conditions.
Unconfirmed: The report does not confirm in-the-wild exploitation or say whether Cloudflare has fixed the chain.
- The cache behavior was observed in Chromium, not Firefox or Safari.
- A restrictive CSP, including default-src 'none', initially blocked the injected script.
- Permissive image sources simplify the chain; restricted sources need an eligible redirect.
- The researchers also applied the cache primitive to Netlify Image CDN and some public S3 objects.
- The report gives no CVE identifier or remediation timeline.
Impact: Same-origin JavaScript execution through the image endpoint
| Product | Affected |
|---|---|
| Cloudflare Image Transformations | — |
- Vendors
- Cloudflare
- Victims
- Cloudflare
From the original article
3 min read at gbhackers.com
Security researchers have demonstrated an attack chain against Cloudflare’s Image Transformations service that bypasses SVG sanitization and Content Security Policy (CSP), enabling malicious JavaScript execution on a targeted website’s origin. Published on October 28, 2026, the research combines an XML serialization flaw, Chromium cache behavior, and redirects that circumvent image source restrictions.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.