Batik SVG color-profile xml:base bypasses same-origin checks (CVE-2026-49236)
Apache rates the Batik external-resource bypass moderate; the oss-security note does not list versions or a fix.
Stories per day · 30 days
3 RSS
Relatedxss3cloudflare2apache1batik1benchmark1content-security-policy1csp-bypass1cve-2026-968891firefox1image-cdn1image-proxy1lottie1motion-graphics1next.js1patch1portswigger1rce1react1
13 stories, newest first · one card per story
Stories tagged #svg
MotionGraphicsBench scores SVG motion edits with verification programs
Pass@1 across 47 configurations ranged from 6.0% to 67.7%, and verifiers agreed with humans 93.3% of the time.
Cloudflare Image Transformations chain bypasses CSP for XSS
Researchers combined an SVG sanitizer bug, Chromium cache behavior, and redirects; no CVE or wild exploitation is confirmed.
1
Researchers chain Cloudflare image flaws into a CSP-bypass XSS
A public write-up shows script execution via /cdn-cgi/image/ using an SVG namespace bug and a Chromium cache quirk.
18
Researcher bypasses six of eight popular SVG sanitizers
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution
Vercel patched unauthenticated Next.js remote code execution in SVG image optimization, with no active exploitation reported.
Mistral Large 4
Simon Willison compares Mistral Large 4 with Claude, GPT, and Gemini on a whimsical SVG prompt.
USN-8891-1: librsvg vulnerability
Ubuntu reports a librsvg flaw that may allow denial of service or arbitrary code execution.
Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content
Unauthenticated attackers can execute code on Next.js 16.2.0–16.3.5 servers via crafted SVG in ImageResponse.
USN-8835-1: Emacs vulnerability
Ubuntu warns Emacs can crash or leak data when opening a crafted SVG image.
usvg SVGZ decompression bomb in `Tree::from_data`
usvg automatically decompresses SVGZ in Tree::from_data, enabling a gzip decompression-bomb denial of service.
Critical NEXT.JS Flaw Allows Remote Code Execution Via Weaponized SVG File
Next.js CVE-2026-94545 can allow unauthenticated remote code execution through malicious SVG in ImageResponse.
2
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
Vercel patched critical Next.js ImageResponse flaw CVE-2026-94545 (CVSS 9.5) allowing server code execution via crafted SVG input; no attacks reported yet.