Cloudflare Image Transformation Flaw Allows Hackers to Bypass CSP and Execute Malicious JavaScript

Security researchers have demonstrated an attack chain against Cloudflare’s Image Transformations service that bypasses SVG sanitization and Content Security Policy (CSP), enabling malicious JavaScript execution on a targeted website’s origin.

Published on October 28, 2026, the research combines an XML serialization flaw, Chromium cache behavior, and redirects that circumvent image source restrictions. Exploitation depends on specific service configurations and browser navigation conditions, so it won’t affect every Cloudflare customer automatically.

Researchers Kevin Gervot and Adam Kues described the findings in their technical analysis. The attack targets /cdn-cgi/image/, a managed endpoint served from customers’ own hostnames.

This placement makes the security boundary significant: if an attacker defeats the endpoint’s safeguards, they can retrieve attacker-controlled content through the service and turn it into a same-origin cross-site scripting (XSS) payload.

Cloudflare Image Transformation Flaw

The first weakness involves svg-hush, Cloudflare’s Rust-based SVG sanitizer, and the xml-rs library responsible for XML serialization. While ordinary attribute values were escaped before output, namespace declarations followed a separate processing path. Their URI values were written directly into serialized markup without equivalent escaping, allowing crafted namespace content to escape its quoted value.

The researchers used a prefixed SVG root element to satisfy namespace validation while placing encoded malicious markup inside the default namespace declaration.

During serialization, that content became an injected script element after sanitization had finished. However, Cloudflare’s restrictive CSP, including default-src ‘none’, initially prevented the injected JavaScript from executing. The sanitizer bypass alone was therefore insufficient.

The second stage exploited Cloudflare’s forwarding of origin-supplied Cache-Control headers. By returning Cache-Control: no-cache=”Content-Security-Policy”, an attacker could cause Chromium to exclude CSP from the cached response while retaining its body.

The initial navigation remained protected; the dangerous change occurred when the browser subsequently reused the cached representation. Researchers found this selective-header behavior in Chromium, but not Firefox or Safari.

To reach that representation, the demonstration opened a new window, navigated it to an attacker-controlled page, and invoked history.back().

Under the demonstrated conditions, the retained window.opener relationship prevented restoration from the back/forward cache, forcing an HTTP-cache reload without CSP. This mechanism differs from earlier browser-cache CSP bypass research, which reused a leaked nonce rather than removing the policy header.

The final stage addressed how attackers could supply their SVG when image sources were restricted. Researchers found that the image fetcher followed redirects without rechecking destination origins. Where Cloudflare Access was enabled on any hostname in a zone, its logout endpoint could be chained with an open redirect on a Cloudflare research subdomain, ultimately fetching an attacker-hosted image.

The team demonstrated XSS on Cloudflare’s own website. Unlike generic cross-site scripting vulnerabilities, this chain crossed several independently implemented defenses.

Permissive image-source settings simplified exploitation, while restricted settings required an eligible redirect route. The published report does not provide a CVE identifier, remediation timeline, or confirmation of exploitation in the wild.

The researchers also extended the cache primitive to Netlify Image CDN and publicly readable S3 objects under specific conditions. Their central finding is that sanitizing content alone cannot establish safety when forwarded headers can later change browser enforcement or parsing. Image proxies and storage integrations must treat response metadata as part of the same security boundary as the fetched document itself.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.