Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107380 · GHSA-9rjx-3jch-6vjf

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Risk score
44/100
CVSS
5.4 v3.1
Exploit chance (30 days)
0.2%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefi…
Affected
enshrined/svg-sanitize (composer) <= 0.22.0
Fix
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Exploitation
Public proof of concept

Story map

Story map: enshrined/svg-sanitizeTHE FLAWSTHE FIXCVE-2026-107380Stored XSS via DTD Entity /HTML5 Named CharacterReference CollisionCVSS 5.4 · EPSS 0%CVE-2026-107381Svg-sanitizer: Mixed-casexlink:HrEf skips the `<use>`nesting-DoS check in…CVSS 6.5 · EPSS 0%CVE-2026-107379Denial of Service via DTDAttribute Declaration CrashCVSS 6.5 · EPSS 0%Upgrade…1.0.0or later on your release lineWho is exposedenshrined/svg-sanitize(composer) <= 0.22.0YELLOW · PLAN IT INenshrined/svg-sanitizesvg-sanitizer is a PHP SVG/XMLsanitizer. Prior to 1.0.0,Resolver::processReferences() insrc/ElementReference/Resolver.php builds the SVG <use>reference graph with acase-sensitive href attribute…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

enshrined/svg-sanitize: Yellow, plan it in. svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> e…

The flaws

  • CVE-2026-107380: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (CVSS 5.4 · EPSS 0%)
  • CVE-2026-107381: Svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107379: Denial of Service via DTD Attribute Declaration Crash (CVSS 6.5 · EPSS 0%)

The fix

Upgrade enshrined/svg-sanitize: 1.0.0 or later on your release line

Who is exposed: enshrined/svg-sanitize (composer) <= 0.22.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.4 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
enshrined/svg-sanitizecomposer<= 0.22.01.0.0

References

Original description

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.