Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/
Comments on “Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Security researchers at Sublime-style firm SL Cyber (slcyber.io) report an XSS in Cloudflare's /cdn-cgi/image/ endpoint, demonstrated on cloudflare.com. It chains an svg-hush sanitizer bypass via unescaped xmlns values in xml-rs, Chromium's Cache-Control no-cache="Content-Security-Policy" cache behavior, and a Cloudflare Access redirect. The same header trick is reported to work on Netlify Image CDN and on S3 signed URLs. Fixes are not described. For builders, proxied origin headers and URL-controlled header overrides are part of the security boundary; several findings were unsourced or unchecked.
Why it ranked
No. 9 of 127 with a score of 0.74. The panel rated it highest on technical depth (0.96) and new information (0.91), lowest on audience breadth (0.66). Placed No. 9, No. 7 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed, reproducible web security research with a full XSS chain across Cloudflare, Chromium, Netlify and S3; highly technical and relevant to builders, though a niche vulnerability class with no prior coverage in the list.
- AI judgeJudge 3gpt-5.6-luna
- Detailed vulnerability research presents reproducible exploit chains across Cloudflare, Netlify, Chromium, and object storage, with code, protocol behavior, and implementation analysis. It is highly actionable for security-minded builders and contains information not represented in the recent-story list.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.74total under rubric v2.3
- Significance0.66
- Reader interest0.86
- Audience breadth0.66
- Practical relevance0.71
- Substantiated0.88
- Technical depth0.96
- New information0.91
- Counts against: Promotional0.03
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.61 | 0.60 | 0.78 | 0.66 | 0.18 | +0.24 | +0.159 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.73 | 0.90 | 0.94 | 0.86 | 0.21 | +0.26 | +0.223 |
| Audience breadthHow many people who build technology does it concern? | 0.67 | 0.67 | 0.63 | 0.66 | 0.04 | +0.13 | +0.086 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.69 | 0.70 | 0.76 | 0.71 | 0.07 | +0.22 | +0.157 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.89 | 0.85 | 0.91 | 0.88 | 0.06 | +0.05 | +0.044 |
| Technical depthHow technically substantive is it? | 1.00 | 0.92 | 0.95 | 0.96 | 0.08 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.92 | 0.85 | 0.97 | 0.91 | 0.12 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.05 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.23 | 0.20 | 0.12 | 0.18 | 0.11 | −0.11 | −0.020 |
| Sum of contributions | +0.736 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.736 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-30/9/"><img src="https://rubric.hrih.si/badge/2026-10-30/9.svg" alt="Ranked #9 on Rubric, 30 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 4 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
Cloudflare sits in front of 24.3% of all websites and represents more than 84% of the measured reverse-proxy market.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “it sits in front of 24.3% of all websites and represents more than 84% of the measured reverse-proxy market”
The source says No passage could be compared.
Source cited by the article: w3techs.com/technologies/overview/proxy
Matches sourceNumber
In svg-hush's xml-rs configuration, perform_escaping defaults to true, so ordinary attribute values are escaped.
The cited source says the same thing.
The article says “In the configuration used by svg-hush, perform_escaping defaults to true”
The source says “Whether or not characters in output events will be escaped. Default is true”
Source cited by the article: github.com/netvl/xml-rs/blob/798543db49000767ff4dae131fd2a9ea5fe7310b/src/writer/config.rs
Matches sourceCausal conclusion
xml-rs's emit_current_namespace_attributes writes namespace URI values into the serialized output without escaping, allowing breakout from the quoted xmlns value.
The cited source says the same thing.
The article says “During serialization, emit_current_namespace_attributes inserted their URI values directly into the output without escaping”
The source says “NS_NO_PREFIX => if uri == NS_EMPTY_URI { Ok(()) } else { write!(target, " xmlns=\"{uri”
Source cited by the article: github.com/netvl/xml-rs/blob/798543db49000767ff4dae131fd2a9ea5fe7310b/src/writer/emitter.rs
No source givenFirst, only or fastest
Among Chromium, Firefox and Safari, only Chromium implements the selective-header behavior of Cache-Control no-cache with a field-name argument.
The article gives no link or citation for it.
The article says “we found that Chromium was the only one that implemented this selective-header behavior”
The source says No source to compare with.
Matches sourceDate
The history-navigation technique for loading a cached response from Chromium's disk cache has been known in CTFs since 2022 and was demonstrated by @arkark_ in the SECCON 2022 spanote write-up.
The cited source says the same thing.
The article says “This technique has been known in CTFs since 2022. It was demonstrated by @arkark_ in the SECCON 2022 spanote write-up”
The source says “Let me get straight to the point, in my solution, you can XSS by abusing cache behavior in Google Chrome”
Source cited by the article: blog.arkark.dev/2022/11/18/seccon-en
No source givenCausal conclusion
The /cdn-cgi/image/ image fetcher follows HTTP redirects without checking whether the destination is allowed by the source configuration, so an open redirect on any allowed origin lets an image load from an arbitrary domain.
The article gives no link or citation for it.
The article says “the image fetcher follows HTTP redirects without checking whether the redirect destination is still allowed by the source configuration”
The source says No source to compare with.
No source givenGeneralization
When Cloudflare Access is enabled on any hostname in a zone, /cdn-cgi/access/login and /cdn-cgi/access/logout become available on every proxied hostname in that zone.
The article gives no link or citation for it.
The article says “when Cloudflare Access is enabled on any hostname in a zone, /cdn-cgi/access/login and /cdn-cgi/access/logout become available on every proxied hostname in that zone”
The source says No source to compare with.
No source givenCausal conclusion
On Netlify Image CDN, the Cache-Control no-cache primitive could remove both Content-Security-Policy and Content-Type, turning an SVG sanitizer parsing differential into HTML execution.
The article gives no link or citation for it.
The article says “On Netlify Image CDN, it could remove both Content-Security-Policy and Content-Type, turning an SVG sanitizer parsing differential into HTML execution”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 30 Oct 2026, 05:47 UTC. It played no part in the ranking.