Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107379 · GHSA-v383-3rw5-q8rf

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Risk score
55/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, w…
Affected
enshrined/svg-sanitize (composer) <= 0.22.0
Fix
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Exploitation
Public proof of concept

Story map

Story map: enshrined/svg-sanitizeTHE FLAWSTHE FIXCVE-2026-107379Denial of Service via DTDAttribute Declaration CrashCVSS 6.5 · EPSS 0%CVE-2026-107381Svg-sanitizer: Mixed-casexlink:HrEf skips the `<use>`nesting-DoS check in…CVSS 6.5 · EPSS 0%CVE-2026-107380Stored XSS via DTD Entity /HTML5 Named CharacterReference CollisionCVSS 5.4 · EPSS 0%Upgrade…1.0.0or later on your release lineWho is exposedenshrined/svg-sanitize(composer) <= 0.22.0YELLOW · PLAN IT INenshrined/svg-sanitizesvg-sanitizer is a PHP SVG/XMLsanitizer. Prior to 1.0.0,Resolver::processReferences() insrc/ElementReference/Resolver.php builds the SVG <use>reference graph with acase-sensitive href attribute…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-770)202 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

enshrined/svg-sanitize: Yellow, plan it in. svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> e…

The flaws

  • CVE-2026-107379: Denial of Service via DTD Attribute Declaration Crash (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107381: Svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107380: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (CVSS 5.4 · EPSS 0%)

The fix

Upgrade enshrined/svg-sanitize: 1.0.0 or later on your release line

Who is exposed: enshrined/svg-sanitize (composer) <= 0.22.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
enshrined/svg-sanitizecomposer<= 0.22.01.0.0

References

Original description

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.