enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

CVE-2026-107380

The savg-sanitizer PHP SVG/XML sanitizer is vulnerable to Stored XSS in versions prior to 1.0.0 . The issue stems from a discrepancy between isHrefSafeValue(), which validates href attributes after XML DTD entity expansion, and saveXML(), which serializes the original entity reference after remov...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

EUVD-2026-95137

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

PYSEC-2026-3748

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...