CVE-2026-945455.3MediumCWE-116

CVE-2026-94545: Satori-generated SVG has improper escaping

vercel · satori

No fix listed · Affected: vercel satori · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public3 public GitHub repositories (unverified), listed by PoC-in-GitHub23 Sep
Not established: not seen

1.1%probability of exploitation in the next 30 days

65th percentile

050100

Higher than 65% of scored CVEs

5.3MediumCVSS 4.0

LowMediumHighCrit.

DescriptionNVD

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Encoding or Escaping of Output · Injection and Smuggling
Vendor: vercel
Published: September 2026
Band: Possible (1 to 10%), September 2026

What changed

23 Sep
PoC-in-GitHub lists 3 public GitHub repositories (unverified) PoC-in-GitHub

Coverage2 articles · 1 outlet

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 23 Sep.

Full timeline

Quiet for 6 weekslast report 1 Oct2 articles1 outlet

First report
Article
Running total

Show as table

2 articles about CVE-2026-94545 from 1 outlets
Published (UTC)	Outlet	Headline
23 Sep 08:11	SecurityOnline	Vercel Fixes Critical Next.js Flaw Enabling Unauthenticated RCE
1 Oct 10:28	SecurityOnline	Public PoC Exploits Critical Next.js Flaw for Remote Code Execution

1 Oct 10:28
Public PoC Exploits Critical Next.js Flaw for Remote Code Execution
SecurityOnline
23 Sep 08:11
Vercel Fixes Critical Next.js Flaw Enabling Unauthenticated RCE
SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.