All vulnerabilities
CVE-2026-94545GHSA-vcvr-r3jv-pc5jGHSA-wx4j-mvgx-mqwp

Satori-generated SVG has improper escaping

vercel satorinpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.04%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.3.6Also 0.33.5GitHub
Published30 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 16.3.6next, npmGitHubnpm install next@16.3.6
  • 0.33.5satori, npmGitHubnpm install satori@0.33.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

Text from CVE List

Affected versions 5

  • satoriaffected: >= 0.0.27, < 0.33.5CVE List
  • nextaffected: >= 16.2.0, < 16.3.6CVE List
  • next, npm>= 16.2.0 < 16.3.6GitHub
  • satori, npm>= 0.0.27 < 0.33.5GitHub
  • next, npmfrom 16.2.0, fixed in 16.3.6OSV

References 6