The vulnerability exists in darylldoyle svg-sanitizer versions before 1.0.0 and allows CSS injection and remote reference bypass. Unsanitized style content, unquoted url() values, and unescaped image href attributes enable an attacker to embed external resources in an SVG file. This can lead to page data exfiltration, user tracking, or disclosure of visitor IP addresses.

Affected systems are applications that incorporate the svg-sanitizer library prior to 1.0.0, specifically darylldoyle svg-sanitizer before 1.0.0. No other vendors or products are listed as affected.

The CVSS score is 5.1, indicating moderate risk, and the EPSS score is unavailable, making exploitation probability uncertain. The vulnerability is not listed in CISA KEV. Attackers can exploit this by uploading a crafted SVG file to a system that uses the vulnerable library for sanitization. No remote code execution is possible, but data disclosure and tracking constitute the main security concern.