Researcher bypasses six of eight popular SVG sanitizers
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #xslt
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
GeoNetwork patched two chained flaws (CVE-2026-63219, CVE-2026-58400) enabling unauthenticated RCE in government geospatial metadata catalogs.
1