Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Researchers chain Cloudflare image flaws to run script despite CSP

2 sources · 2 articlesFirst reported Updated ()1 · 1 read
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A public write-up shows JavaScript execution on cloudflare.com via Image Transformations; no CVE, patch, or confirmed wild exploitation.

Searchlight Cyber researchers Kevin Gervot and Adam Kues published an October 28, 2026 analysis showing that weaknesses in Cloudflare Image Transformations can be chained to run JavaScript on cloudflare.com despite a strict content security policy. The chain uses an xml-rs namespace escaping gap in svg-hush, Chromium-only cache handling of a forwarded Content-Security-Policy header, and redirects—including a Cloudflare Access logout path in some setups—to fetch an attacker-controlled image. A restrictive CSP, including default-src 'none', initially blocked the injected script; permissive image sources simplify the chain, while restricted sources need an eligible redirect. Exploitation depends on configuration and browser conditions. The write-up lists no CVE, patch, or remediation timeline, and no wild exploitation is confirmed. Related cache and header issues were described for Netlify, Amazon S3, and Google Cloud Storage.

Key facts
  • svg-hush writes xmlns values raw after xml-rs has approved the file.
  • Only Chromium, not Firefox or Safari, drops the CSP header after a disk-cache reload.
  • Cloudflare Access logout returnTo accepts any cloudflare.com subdomain.
  • Researchers demonstrated XSS on Cloudflare’s own website.
  • The same cache primitive was applied to Netlify Image CDN and some public S3 objects.
  • No CVE identifier or remediation timeline was given.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Researchers publish the Cloudflare image-transformation XSS chain. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsNames Searchlight Cyber, Access returnTo scope, and Google Cloud Storage.
  • GBHackersNo confirmed wild exploitation; Firefox and Safari not affected.
Vendors
CloudflareNetlifyAmazonGoogle
Products
Cloudflare Image Transformationssvg-hushNetlify Image CDNAmazon S3Google Cloud StorageImage Transformations
Victims
Cloudflare
Organizations
Searchlight Cyber

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Cyber Security NewsFirst report

    Researchers chain Cloudflare image flaws into a CSP-bypass XSS

    A public write-up shows script execution via /cdn-cgi/image/ using an SVG namespace bug and a Chromium cache quirk.

  2. · 1d ago GBHackers

    Cloudflare Image Transformations chain bypasses CSP for XSS

    Researchers combined an SVG sanitizer bug, Chromium cache behavior, and redirects; no CVE or wild exploitation is confirmed.