Loading HuntDB...

GHSA-9gr3-7897-pp7m

GitHub Security Advisory

XSS in Image Optimization API for Next.js

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

### Impact
- **Affected:** All of the following must be true to be affected
- Next.js between version 10.0.0 and 11.1.0
- The `next.config.js` file has [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) array assigned
- The image host assigned in [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) allows user-provided SVG
- **Not affected**: The `next.config.js` file has [`images.loader`](https://nextjs.org/docs/basic-features/image-optimization#loader) assigned to something other than default
- **Not affected**: Deployments on [Vercel](https://vercel.com) are not affected

### Patches
[Next.js v11.1.1](https://github.com/vercel/next.js/releases/tag/v11.1.1)

Affected Packages

npm next
Affected versions: 10.0.0 (fixed in 11.1.1)

Related CVEs

Key Information

GHSA ID
GHSA-9gr3-7897-pp7m
Published
September 1, 2021 6:24 PM
Last Modified
August 31, 2021 8:01 PM
CVSS Score
7.5 /10
Primary Ecosystem
npm
Primary Package
next
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.