CVE-2026-121447
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.