Researcher bypasses six of eight popular SVG sanitizers
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
Stories per day · 30 days
1 RSS
2 stories, newest first · one card per story
Stories tagged #sanitizer
CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Apache Sling XSS before 2.4.12 has a moderate XSS sanitizer bypass, CVE-2026-91928.