5.3
Medium
Satori-generated SVG has improper escaping
CVE-2026-94545
Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.
Proof-of-concept code is published
Public PoC
- Public PoCEQSTLab/CVE-2026-9454552 stars
- Public PoCHORKimhab/CVE-2026-945451 stars
- Public PoCHassham1/CVE-2026-94545-nextjs-og-poc1 stars
- Public PoCMRdark-ops/CVE-2026-94545-1 stars
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 5.3 (v4.0)
- Severity
- Medium
- EPSS
- 0.01082% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- npm · satori
- Weakness
- CWE-116
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
At the source
References
- https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
- https://nvd.nist.gov/vuln/detail/CVE-2026-94545
- https://github.com/vercel/satori/pull/814
- https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
- https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
- https://github.com/vercel/next.js/releases/tag/v16.3.6
- https://github.com/advisories/GHSA-wx4j-mvgx-mqwp
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-94545