CVE-2026-121445
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service…
- Risk score
- 42/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitiz…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.1.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
References
Original description
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.
Last activity 3 Nov 2026. Patch Forecast updates every hour.