What is GHSA-w5hc-8c8h-8vm3?

GHSA-w5hc-8c8h-8vm3 is a security advisory published by GitHub Security Advisories with Medium severity. svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to...

Which CVE IDs does GHSA-w5hc-8c8h-8vm3 cover?

GHSA-w5hc-8c8h-8vm3 covers the following CVE IDs: CVE-2026-121447. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w5hc-8c8h-8vm3?

GHSA-w5hc-8c8h-8vm3 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-w5hc-8c8h-8vm3MediumCVSS 6.1

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-121447 →

📋 Description

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

🔗 References (4)

https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-q546-85r6-f39q
https://nvd.nist.gov/vuln/detail/CVE-2026-121447
https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-xss-via-animatetransform-on-safari
https://github.com/advisories/GHSA-w5hc-8c8h-8vm3