Quick answers
- Is CVE-2026-30117 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-30117 being exploited in the wild.
- How severe is CVE-2026-30117?
- Informational severity, with a CVSS score of 6.1, published 19 May 2026.
- Which products and versions are affected?
- Scalar astro 0.1.13.
- Is there a fix for CVE-2026-30117?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-30117 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-30117?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the Scalar Proxy endpoint of the scalar/astro package (v0.1.13). The 'scalar_url' query parameter accepts an arbitrary URL pointing to an external SVG file, which the proxy fetches and serves to the user's browser without sanitization or a restrictive Content Security Policy (CSP). Because SVG files can contain embedded JavaScript, an attacker can host a malicious SVG that executes scripts in the context of the proxy's domain (e.g., proxy.scalar.com). This results in Reflected Cross-Site Scripting (XSS) and can also be used for Open Redirects. The root cause is the failure to strip script tags from SVG content and the lack of origin restrictions on the upstream URL.
Affected products
- Scalar astro 0.1.13
Timeline
- 2026-05-19: disclosed: Vulnerability details published on GitHub and NVD
- 2026-05-19: advisory