CVE-2026-121443mediumCWE-248

CVE-2026-121443: falha de média gravidade em darylldoyle svg-sanitizer

svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

Publicada em

Seguir esta CVE+ Monitorar svg-sanitizer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
darylldoyle · svg-sanitizer
CVEs relacionadas — darylldoyle svg-sanitizer

No mesmo produto, das mais perigosas para as menos.

CVE-2022-23638MEDIUMCross-site Scripting in svg-sanitizerEPSS 0.7%CVE-2025-55166MEDIUMsvg-sanitizer By-Passing Attribute SanitizationEPSS 0.5%CVE-2026-107379MEDIUMenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-121444HIGHsvg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference GraphEPSS 0.4%CVE-2026-121445HIGHsvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingEPSS 0.4%