svg-sanitizer CVE-2026-121447

Requires an application that (a) uses svg-sanitizer / enshrined/svg-sanitize version <=1.0.0 to sanitize SVG input and (b) allows an attacker to supply or upload SVG content that is later rendered to other users. The crafted file must use <animateTransform attributeName="href" ... values="...;javascript:..."> to overwrite an <a> element's href with a javascript: URL. Exploitation is strongly limited: it executes ONLY in Apple Safari (which uniquely permits animateTransform to target href), the victim must click the affected link (UI required per UI:P), and it does not work in Chrome, Firefox or other engines. Applications on 1.1.0+ are not affected.

This is a genuine but moderate-risk stored-XSS sanitizer bypass, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L/SC:L/SI:L, base 5.3 Medium) correctly reflects a network-reachable flaw with no privileges but mandatory user interaction and only low/partial impact. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with the medium score. The single most important limiting signal is NOT captured by CVSS: the GHSA advisory states the XSS triggers only on Safari, because Safari uniquely lets animateTransform's attributeName target href. On Chrome, Firefox and other engines the payload does not execute, so real-world impact is scoped to the Safari-using subset of victims. There is no CISA KEV entry and no EPSS score in the supplied data, so exploitation probability cannot be quantified here; absence of KEV means no confirmed active exploitation. A concrete working PoC payload is published in the GHSA advisory and is accepted by the live demo sanitizer (svg.enshrined.co.uk), which raises practical exploitability for anyone running the vulnerable version. Net: a real, publicly-detailed bypass worth patching on a normal cycle, with risk tempered by the Safari-only trigger and the required victim click.

An application uses svg-sanitizer (<=1.0.0) to sanitize user-uploaded SVGs and serves them back to other users. An attacker uploads an SVG containing an <a href> element plus an animateTransform whose attributeName is href and whose values include a javascript: URL (the exact payload is published in the GHSA advisory). When a victim using Safari views the file and clicks the animated link, the javascript: URL executes in the victim's session; non-Safari browsers do not trigger it.