Cache Me If You Can: XSS in Cloudflare's /CDN-CGI/Image/

Security researchers at Sublime-style firm SL Cyber (slcyber.io) report an XSS in Cloudflare's /cdn-cgi/image/ endpoint, demonstrated on cloudflare.com. It chains an svg-hush sanitizer bypass via unescaped xmlns values in xml-rs, Chromium's Cache-Control no-cache="Content-Security-Policy" cache behavior, and a Cloudflare Access redirect. The same header trick is reported to work on Netlify Image CDN and on S3 signed URLs. Fixes are not described. For builders, proxied origin headers and URL-controlled header overrides are part of the security boundary; several findings were unsourced or unchecked.