CVE-2026-84371

[CVE catalog]

A flaw was found in sanitize-html. Improper validation of the animation value attributes in SVG files allows an attacker to bypass scheme filters and embed a malicious script destination within a list of values. When a user interacts with the rendered SVG animation, the embedded script executes in the context of the application, leading to Cross-Site Scripting (XSS). sanitize-html: stored XSS via SVG SMIL URI-list scheme-policy bypass To exploit this flaw, an attacker needs to trick a user into clicking or interacting with a malicious rendered SVG file, reducing the likelihood of exploitation. Additionally, this vulnerability can only be triggered in configurations that allow the animate, animateColor, animateMotion, animateTransform or set elements. For these reasons, this issue has been rated with a moderate severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Published

Sep 1, 2026, 8:51:10 PM UTC

Updated

Sep 1, 2026, 9:18:48 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.30% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "sanitize-html",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "2.17.7"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "provider_url": "https://osv.dev/vulnerability/GHSA-g8qq-57p8-ggw5",
      "fixed_version": "2.17.7",
      "provider_source": "pypi",
      "provider_record_id": "GHSA-G8QQ-57P8-GGW5",
      "provider_updated_at": "2026-09-03T16:25:59.256534742Z",
      "applicability_unknown": true
    }
  ]
}