Cloudflare Image Transformation Flaw Allows Hackers to Bypass CSP and Execute Malicious JavaScript

Security researchers have demonstrated an attack chain against Cloudflare’s Image Transformations service that bypasses SVG sanitization and Content Security Policy (CSP), enabling malicious JavaScript execution on a targeted website’s origin. Published on October 28, 2026, the research combines an XML serialization flaw, Chromium cache behavior,... Weiterlesen: Cloudflare Image Transformation Flaw Allows Hackers to Bypass CSP and…