Is CVE-2026-121447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121447 being exploited in the wild.

How severe is CVE-2026-121447?

Medium severity, with a CVSS score of 6.1, published 3 November 2026.

Which products and versions are affected?

Enshrined Svg-Sanitizer before 1.1.0.

Is there a fix for CVE-2026-121447?

Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121447 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121447?

Check whether you run Enshrined Svg-Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121447: svg-sanitizer cross-site scripting via animateTransform

CVE-2026-121447 · Severity: medium · CVSS 6.1 · Published 2026-11-03

svg-sanitizer is a library that removes potentially dangerous code from SVG files to prevent attacks. A flaw in versions before 1.1.0 allows attackers to bypass this protection by using SVG animation features to inject malicious JavaScript code. When a Safari user clicks a link in a crafted SVG file, the injected code executes, potentially stealing data or performing unauthorized actions.

Technologies: Enshrined Svg-Sanitizer. Vendors: Enshrined.

Quick answers

Is CVE-2026-121447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121447 being exploited in the wild.
How severe is CVE-2026-121447?: Medium severity, with a CVSS score of 6.1, published 3 November 2026.
Which products and versions are affected?: Enshrined Svg-Sanitizer before 1.1.0.
Is there a fix for CVE-2026-121447?: Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121447 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121447?: Check whether you run Enshrined Svg-Sanitizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.1.0

Technical details

The vulnerability exists in the sanitization logic for animateTransform SVG elements. An attacker can use animateTransform's values attribute to inject javascript: URLs that target the href attribute of a link element, bypassing the library's XSS filtering. The attack requires user interaction (clicking a link) and is specific to Safari's handling of SMIL animation, where animateTransform can modify arbitrary animatable attributes including href.

Affected products

enshrined svg-sanitizer before 1.1.0

Timeline

2026-10-19: disclosed
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.