fix: text matching Object.prototype property names rendered as image

[rafaumeu]

Problem (#746)

When text content passed to Satori exactly matched an Object.prototype property name (e.g. "constructor", "toString", "valueOf"), the text was silently not rendered. Instead, an <image> element with an invalid href was emitted.

Root Cause

Two locations in src/text/index.ts used bracket-notation lookup on a user-provided graphemeImages object:

1. isImage(s) (line 122): graphemeImages[s] — when s is "constructor", this returns Object.prototype.constructor (a truthy function), so the text was incorrectly treated as an image.

2. Rendering path (line 558): graphemeImages[text] — same issue, returns the inherited property instead of undefined.

Fix

Use Object.prototype.hasOwnProperty.call() to check for own properties before accessing the value:

// Before
graphemeImages[s]

// After
Object.prototype.hasOwnProperty.call(graphemeImages, s) && graphemeImages[s]

Testing

All 433 existing tests pass. The fix only affects edge cases where text exactly matches Object.prototype property names — normal usage is unaffected.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
satori-playground	Ready	Preview, Comment, Open in v0	Jun 17, 2026 9:46pm