CVE-2026-121447 — Vulnerability intelligence
—
Published:
- CVSS
- 5.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.