CVE-2026-94545: Satori-generated SVG has improper escaping
Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup.
The impact depends on how the generated SVG is consumed.
References
- github.com/advisories/GHSA-wx4j-mvgx-mqwp
- github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
- github.com/vercel/next.js/releases/tag/v16.3.6
- github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
- github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
- github.com/vercel/satori/pull/814
- github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
- nvd.nist.gov/vuln/detail/CVE-2026-94545
Code Behaviors & Features
Detect and mitigate CVE-2026-94545 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →