How eqstlab/cve-2026-94545 works
This repository is a vulnerable Next.js reproduction and a proof-of-concept client. The principal workflow is an unauthenticated request to /api/og: the route reads query or body text, embeds it in SVG rendered by ImageResponse, and—on the documented Node.js plus sharp path—passes it through native rasterization. The PoC builds an SVG/XInclude payload containing a ROP chain and sends it to that route; successful execution replaces the server worker with a command, with output returned out of band. The sampled route and exploit support these links; deeper framework and native internals are described in the README, not sampled source.
Main entry points: exploit.py PoC orchestrator · route.jsx OG image route
Components 12
Victim app
- Demo homepage
app/app/page.jsx - OG image route
app/app/api/og/route.jsx
Render and execution
- ImageResponse
- Sharp native rasterizer
- SVG native parsers
- Command execution
Exploit client
- PoC orchestrator
exploit.py - Payload and ROP builder
exploit.py - HTTP payload sender
exploit.py
Other components
- Unauthenticated requester
- Netcat listener
- Chosen shell command
Connections 12
- Unauthenticated requester → OG image route: sends GET or POST
- OG image route → ImageResponse: renders SVG
- ImageResponse → Sharp native rasterizer: rasterizes with sharp
- Sharp native rasterizer → SVG native parsers: uses native SVG stack
- SVG native parsers → Command execution: exploits parser
- PoC orchestrator → Payload and ROP builder: builds payload
- Payload and ROP builder → PoC orchestrator: returns payload
- PoC orchestrator → HTTP payload sender: sends payload
- HTTP payload sender → OG image route: POSTs SVG text
- PoC orchestrator → Netcat listener: starts optionally
- Command execution → Chosen shell command: runs
- Chosen shell command → Netcat listener: connects out of band