Read the docs
TI-2026-63464 Aliases CVE-2026-94545GHSA-wx4j-mvgx-mqwp

Satori-generated SVG has improper escaping

Priority LOW 26CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01082 65th percentileScored 2026-11-07
Fix Fixed satori (vercel): 0.33.5next (vercel): 16.3.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelsatori0.0.27 to before 0.33.50.33.5Patch availableCNA
vercelnext16.2.0 to before 16.3.616.3.6Patch availableCNA
—satori (npm)0.0.27 to before 0.33.50.33.5Patch availableGHSA-wx4j-mvgx-mqwp
  • satori Vendorvercel Affected 0.0.27 to before 0.33.5 Fixed in 0.33.5 Patch available CNA
  • next Vendorvercel Affected 16.2.0 to before 16.3.6 Fixed in 16.3.6 Patch available CNA
  • satori (npm) Vendor— Affected 0.0.27 to before 0.33.5 Fixed in 0.33.5 Patch available GHSA-wx4j-mvgx-mqwp

Remediation

  • Fix · CNA satori (vercel) Fixed in 0.33.5
  • Fix · CNA next (vercel) Fixed in 16.3.6
  • Fix · GHSA-wx4j-mvgx-mqwp satori (npm) Fixed in 0.33.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94545
  2. 2026-10-27 Alias added: GHSA-wx4j-mvgx-mqwp

References

Advisory 1

Other 7

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2024-15745 An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences