Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107381 · GHSA-m9xh-6747-9r6f

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Risk score
56/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.4%
Published
8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> e…
Affected
enshrined/svg-sanitize (composer) <= 0.22.0
Fix
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Exploitation
Public proof of concept

Story map

Story map: enshrined/svg-sanitizeTHE FLAWSTHE FIXCVE-2026-107381Svg-sanitizer: Mixed-casexlink:HrEf skips the `<use>`nesting-DoS check in…CVSS 6.5 · EPSS 0%CVE-2026-107379Denial of Service via DTDAttribute Declaration CrashCVSS 6.5 · EPSS 0%CVE-2026-107380Stored XSS via DTD Entity /HTML5 Named CharacterReference CollisionCVSS 5.4 · EPSS 0%Upgrade…1.0.0or later on your release lineWho is exposedenshrined/svg-sanitize(composer) <= 0.22.0YELLOW · PLAN IT INenshrined/svg-sanitizesvg-sanitizer is a PHP SVG/XMLsanitizer. Prior to 1.0.0,Resolver::processReferences() insrc/ElementReference/Resolver.php builds the SVG <use>reference graph with acase-sensitive href attribute…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-178 (CWE-178)16 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

enshrined/svg-sanitize: Yellow, plan it in. svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> e…

The flaws

  • CVE-2026-107381: Svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107379: Denial of Service via DTD Attribute Declaration Crash (CVSS 6.5 · EPSS 0%)
  • CVE-2026-107380: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (CVSS 5.4 · EPSS 0%)

The fix

Upgrade enshrined/svg-sanitize: 1.0.0 or later on your release line

Who is exposed: enshrined/svg-sanitize (composer) <= 0.22.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
enshrined/svg-sanitizecomposer<= 0.22.01.0.0

References

Original description

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.