Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript
https://cybersecuritynews.com/cloudflare-xss-vulnerability/
Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript
Cloudflare XSS Flaws
Cloudflare sits in front of 24.3% of all websites. When a site joins Cloudflare, the company adds a managed /cdn-cgi/ path to that site’s own domain. Features such as bot checks, Web Analytics, Access, and Image Transformations live there.
Because these pages load from the customer’s own domain, a bug in them runs with that site’s trust. Other researchers had already found Content Security Policy (CSP) bypasses in this path. CSP is a browser rule set that limits which scripts a page may run.
Cloudflare cleans SVG images with svg-hush, a Rust tool built on the xml-rs library. The tool checks the file, then writes it back out. The researchers found that xml-rs escapes normal attribute values but writes namespace values (the xmlns setting) raw.
An attacker can hide a quote mark in that value and break out of it. The filter has already approved the file by then, so the script tag slips through. Cloudflare serves these images with a strict policy of default-src ‘none’, which blocks scripts. However, the endpoint passes along Cache-Control headers from the source image.
Security researchers at Searchlight Cyber chained several small flaws in Cloudflare’s image feature. The chain let them run JavaScript on a site that was meant to block it.
Kevin Gervot and Adam Kues published the work on October 28, 2026, in a write-up titled Cache Me If You Can. They showed a working cross-site scripting (XSS) bug through the /cdn-cgi/image/ endpoint on cloudflare.com. The write-up does not list a CVE or a patch status, so readers should check with Cloudflare.
...
The HTTP rules allow a form such as no-cache=”Content-Security-Policy”, which tells a cache to drop the named header. Only Chromium follows this rule, and it accepts any header name. The CSP stays in place on the first load. After Chromium saves the page, the policy is gone.
...
The main lesson is that you shouldn’t trust only a file’s body. Headers passed through by an image service or storage layer become part of your security. Teams should avoid forwarding Cache-Control and X-* headers from untrusted sources.
They should also set X-Content-Type-Options: nosniff and review which sources their image tools may fetch. Closing open redirects helps too. Past work shows that even strong filters can fail, as in WAF bypass research on XSS payloads. Layered defenses still matter.