Quick answers
- Is CVE-2026-93505 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93505 being exploited in the wild.
- How severe is CVE-2026-93505?
- Low severity, with a CVSS score of 3.5, published 18 September 2026.
- Which products and versions are affected?
- SveltyCMS 0.0.6.
- Is there a fix for CVE-2026-93505?
- A patch was published on 2026-08-07: Patch commit 05b4f9efeb79e9d72a693232334d7529687f896f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93505 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-93505?
- Check whether you run SveltyCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the SVG media upload handler within src/utils/media/media-service.server.ts. SVG uploads were not properly sanitized, allowing attackers to embed malicious scripts within SVG payloads that execute when the files are served or previewed. The root cause was that large SVG files could bypass the sanitization buffer, and no Content Security Policy restrictions were applied to the `/files/` serving routes. An attacker with upload privileges can remotely inject JavaScript payloads. The patch (commit 05b4f9efeb79e9d72a693232334d7529687f896f) implements sanitization via `bufferAndSanitizeSvg()`, enforces a strict 5 MiB size limit, and adds `script-src 'none'` CSP headers to file serving endpoints.
Affected products
- SveltyCMS SveltyCMS 0.0.6
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Patch commit 05b4f9efeb79e9d72a693232334d7529687f896f