TI-2026-69645 Aliases CVE-2026-107379 GHSA-v383-3rw5-q8rf

Denial of service in enshrined/svg-sanitize via crafted SVG DTD

MEDIUM 62CWE-770Published 2026-10-08 · Updated 2026-10-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

The enshrined/svg-sanitize PHP package before 1.0.0 is affected by a resource exhaustion flaw (CWE-770). A crafted SVG DTD with a #FIXED attribute default makes the sanitizer remove the same attribute twice, which can corrupt libxml state and terminate the PHP worker. An attacker with low privileges who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade application availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00525 44th percentileScored 2026-11-07

Fix Fixed svg-sanitizer (darylldoyle): 1.0.0enshrined/svg-sanitize (Packagist): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
darylldoyle	svg-sanitizer	before 1.0.0	1.0.0	Patch available	CNA
—	enshrined/svg-sanitize (Packagist)	before 1.0.0	1.0.0	Patch available	GHSA-v383-3rw5-q8rf

svg-sanitizer Vendordarylldoyle Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
enshrined/svg-sanitize (Packagist) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-v383-3rw5-q8rf

Remediation

Upgrade enshrined/svg-sanitize to version 1.0.0, which fixes the issue. No fixed version is listed for the svg-sanitizer entry.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA svg-sanitizer (darylldoyle) Fixed in 1.0.0
Fix · GHSA-v383-3rw5-q8rf enshrined/svg-sanitize (Packagist) Fixed in 1.0.0 Advisory →

Timeline

2026-10-08 Threatist record created from CVE-2026-107379
2026-10-09 Alias added: GHSA-v383-3rw5-q8rf
2026-10-09 Fix available: Packagist/enshrined/[email protected] · GHSA-v383-3rw5-q8rf
2026-10-09 CVSS score added · GHSA-v383-3rw5-q8rf
2026-10-09 Weakness changed · GHSA-v383-3rw5-q8rf
2026-10-09 5 new references · GHSA-v383-3rw5-q8rf
2026-10-09 CISA SSVC decision points changed

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-107379

Other 4

TI-2026-81116 Quadratic CPU exhaustion in svg-sanitizer PHP tag stripping CVSS 4.0HIGH 8.7
TI-2026-84327 svg-sanitizer ReDoS and Fail-Open via image-set CSS Stripping CVSS 4.0HIGH 8.2
TI-2026-74075 Mixed-case xlink:HrEf bypasses use nesting limit in svg-sanitizer CVSS 3.1MEDIUM 6.5
TI-2026-84328 Incomplete url() filtering in svg-sanitizer allows remote URL requests CVSS 4.0MEDIUM 5.3
TI-2026-81115 darylldoyle svg-sanitizer CSS Injection and Remote Reference Bypass CVSS 4.0MEDIUM 5.1
TI-2025-34848 svg-sanitizer By-Passing Attribute Sanitization CVSS 4.0MEDIUM 5.1

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences