Preliminary research

Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/

Kevin Gervot and Adam Kues · Searchlight Cyber · 28 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Shows how unescaped XML namespace metadata bypasses an SVG sanitizer, then Chromium caching drops selected security headers. Chains this with image-source redirects, and extends the cache technique to Netlify XML/HTML parsing and public-object response overrides. Restricted sources and key browser prerequisites are explicit.

Record

Researcher

Kevin Gervot and Adam Kues

Published by

Searchlight Cyber

Date

28 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Sanitizer source

Tags

• xss
• csp
• parser-differential
• svg
• sanitizer-bypass
• cache
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Kevin Gervot and Adam Kues, first published at the original source. Preserved copies are kept so the citation survives its host.