Next
Monthly
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.