Read the docs
TI-2026-84325 Aliases CVE-2026-121443GHSA-8888-g577-32c9

Uncaught exception in svg-sanitizer lets remote attackers crash requests

Priority LOW 30CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service flaw. A remote attacker can upload SVG input that ends inside an unclosed tag, such as a single '<', to trigger an uncaught ValueError from strpos() on PHP 8, which fails the request (CWE-248). The attack needs no privileges or user interaction and can crash requests with a low impact on availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

Why it matters now

EPSS 0.00301 22nd percentileScored 2026-11-07
Fix Fixed svg-sanitizer (darylldoyle): 1.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
darylldoylesvg-sanitizer1.1.0 to before 1.1.11.1.1Patch availableCNA
  • svg-sanitizer Vendordarylldoyle Affected 1.1.0 to before 1.1.1 Fixed in 1.1.1 Patch available CNA

Remediation

Upgrade darylldoyle svg-sanitizer to version 1.1.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA svg-sanitizer (darylldoyle) Fixed in 1.1.1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121443
  2. 2026-11-03 Alias added: GHSA-8888-g577-32c9
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-81116 Quadratic CPU exhaustion in svg-sanitizer PHP tag stripping CVSS 4.0HIGH 8.7
  • TI-2026-84327 svg-sanitizer ReDoS and Fail-Open via image-set CSS Stripping CVSS 4.0HIGH 8.2
  • TI-2026-74075 Mixed-case xlink:HrEf bypasses use nesting limit in svg-sanitizer CVSS 3.1MEDIUM 6.5
  • TI-2026-69645 Denial of service in enshrined/svg-sanitize via crafted SVG DTD CVSS 3.1MEDIUM 6.5
  • TI-2026-84328 Incomplete url() filtering in svg-sanitizer allows remote URL requests CVSS 4.0MEDIUM 5.3
  • TI-2026-81115 darylldoyle svg-sanitizer CSS Injection and Remote Reference Bypass CVSS 4.0MEDIUM 5.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences