October CVE-2026-25133

CVSS 4.8 reflects the relatively constrained attack surface: PR:H (high privileges required) and UI:P (user interaction needed to trigger payload) significantly limit exploitation scope compared to unauthenticated or low-privilege vulnerabilities. However, the combination of stored persistence (XSS remains in the SVG object indefinitely) and privilege escalation potential against superusers elevates real-world concern. EPSS and active exploitation status are not provided in the intelligence data, but the fix availability in stable releases (3.7.14, 4.1.10) and GitHub advisory indicate October developers consider this a real, non-theoretical risk. The attack is not automatable in a meaningful sense-each victim must voluntarily interact with the malicious SVG-but stored XSS permits targeting of high-value accounts (admins) through social engineering or legitimate-appearing content. Organizations running October versions prior to the patched releases should prioritize patching, particularly if editors or admins actively embed or preview user-uploaded SVG content.

An authenticated attacker with media upload permissions (e.g., content editor) crafts an SVG file containing a carefully formatted event handler attribute (e.g., onclick, onload) that bypasses the existing sanitization regex due to whitespace or quote variations. The attacker uploads the SVG through the Media Manager. Later, when a superuser embeds or previews the SVG in a page-either directly or through an iframe-the malicious JavaScript executes in the superuser's browser session with full admin privileges, potentially allowing the attacker to steal session tokens, create new admin accounts, or modify site content.