5.3 Medium

CVE-2026-94545 Satori is a library to convert HTML and CSS to SVG

Description

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

Affected products and versions

Product	Affected versions	Fixed in
satori 0.0	0.0.27 → < 0.33.5	0.33.5
next 16.2	16.2.0 → < 16.3.6	16.3.6

References

github.com github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com
github.com github.com

Timeline

Published September 30, 2026
Last modified September 30, 2026

Track this CVE