What is GHSA-crrh-v25v-h623?

GHSA-crrh-v25v-h623 is a security advisory published by GitHub Security Advisories with Medium severity. darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass...

Which CVE IDs does GHSA-crrh-v25v-h623 cover?

GHSA-crrh-v25v-h623 covers the following CVE IDs: CVE-2026-117539. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crrh-v25v-h623?

GHSA-crrh-v25v-h623 has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

GHSA-crrh-v25v-h623MediumCVSS 3.5

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass...

Vendor

GitHub Security Advisories

Published

October 27, 2026

Last Modified

October 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-117539 →

📋 Description

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

🔗 References (4)

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-qhmf-972w-m957
https://nvd.nist.gov/vuln/detail/CVE-2026-117539
https://www.vulncheck.com/advisories/darylldoyle-svg-sanitizer-before-1.0.0-css-injection-and-remote-reference-bypass
https://github.com/advisories/GHSA-crrh-v25v-h623