CVE Feed

    Dashboard / CVE / CVE-2026-94545

    CVE-2026-94545

    Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

    Published:Sep 30, 2026
    Last Modified:Oct 2, 2026
    EPS:Sep 30, 2026
    EPSS Score:0.00796
    CVSS Score:5.3

    Affected Products

    Vendor
    Vercel
    Product
    Next.js
    Vendor
    Vercel
    Product
    Satori

    Exploits

    https://github.com/EQSTLab/CVE-2026-94545https://github.com/Hassham1/CVE-2026-94545-nextjs-og-pochttps://github.com/HORKimhab/CVE-2026-94545https://github.com/mhtsec/CVE-2026-94545https://github.com/MRdark-ops/CVE-2026-94545-

    Related CVEs

    CVE-2026-94482 (CVSS 8.2) — Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, c…
    CVE-2026-94484 (CVSS 6.3) — Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, a…
    CVE-2026-94485 (CVSS 6.3) — Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev…
    CVE-2026-94483 (CVSS 8.3) — Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimiz…
    CVE-2026-94543 (CVSS 6.3) — Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, s…
    CVE-2026-94544 (CVSS 6.3) — Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use c…
    CVE-2026-94486 (CVSS 2.3) — Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev …
    CVE-2026-103004 (CVSS 6.3) — Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their r…
    CVE-2026-75604 (CVSS 9) — Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, N…
    CVE-2026-64649 (CVSS 8.3) — Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High