Ghostwire

CVE-2026-94545: Satori-generated SVG has improper escaping

MEDIUM CVSS 0.0 EPSS 1.08% Exploit Available 4 PoC

Published: October 27, 2026 | Last Modified: October 27, 2026

Description

Satori-generated SVG has improper escaping

Ghostwire Analysis — What This Means Practically

Exploitation Probability (EPSS): Moderate — 1.08% (65th percentile)

Measurable exploitation probability. Should be patched in the normal vulnerability management cycle.

4 proof-of-concept exploits available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (4)

HORKimhab/CVE-2026-94545
Hassham1/CVE-2026-94545-nextjs-og-poc
EQSTLab/CVE-2026-94545
MRdark-ops/CVE-2026-94545-

References

github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
nvd.nist.gov/vuln/detail/CVE-2026-94545
github.com/vercel/satori/pull/814
github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782
github.com/vercel/next.js/releases/tag/v16.3.6
github.com/advisories/GHSA-wx4j-mvgx-mqwp
www.tenable.com/cve/CVE-2026-94545
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-94545