CVE-2026-107380: falha de média gravidade em darylldoyle svg-sanitizer
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
darylldoyle · svg-sanitizerCVEs relacionadas — darylldoyle svg-sanitizer
No mesmo produto, das mais perigosas para as menos.
CVE-2022-23638MEDIUMCross-site Scripting in svg-sanitizerEPSS 0.7%CVE-2026-107379MEDIUMenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashEPSS 0.5%CVE-2025-55166MEDIUMsvg-sanitizer By-Passing Attribute SanitizationEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-117540HIGHsvg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping LoopEPSS 0.4%CVE-2026-117541MEDIUMsvg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()EPSS 0.3%