// CloudflareMEDIUM
Security researchers disclosed an attack chain targeting Cloudflare's Image Transformations service that combines XML serialization flaws in svg-hush sanitizer, Chromium cache behavior, and redirect bypasses to achieve same-origin XSS. The vulnerability bypasses both SVG sanitization and Content Security Policy, enabling malicious JavaScript execution on affected websites. Exploitation requires specific service configurations and browser navigation conditions. No active exploitation in the wild confirmed; no CVE assigned yet.
- Cloudflare Image Transformation Flaw Allows Hackers to Bypass CS(opens in a new tab)
- Researchers Chain Cloudflare Security Flaws to Bypass CSP and Ex(opens in a new tab)
// Get alerts for Cloudflare