SiYuan <= v3.5.9 - Cross Site Scripting

SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon. id: CVE-2026-31809 info: name: SiYu...

CVE-2026-119342

The Stirling-PDF web application (versions 2.13.1 through 2.13.2 ) is vulnerable to a local file read (LFI) via the POST /api/v1/convert/svg/pdf endpoint. The root cause is a same-origin bypass where a scheme-less root-relative image reference evades SvgSanitizer.isExternalUrl() checks. This allo...

CVE-2026-119342 Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

svg-sanitizer

SVG Sanitizer SVG Sanitizer is a Java library designed to clean SVG files by removing potentially dangerous JavaScript, blocking external resource loading, and preventing XSS Cross-Site Scripting vulnerabilities. It is useful for ensuring that SVG files are safe to use in a variety of application...

SVG-Sanitizer

SVG Sanitizer Whitelist-based PHP SVG sanitizer. Usage load"evil.svg"; // sanitize! $svg-sanitize; // Print out sanitized SVG echo $svg-saveSVG; ? License MIT...

CVE-2026-117541

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117539

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url values, or image href attributes to exfiltrate page...

CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

EUVD-2026-110806

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117541

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize to throw a...

CVE-2026-117541

The svg-sanitizer library (versions 0.11.0 before 1.1.0 ) is vulnerable to an uncaught exception (CWE-248). Attackers can crash calling applications by submitting well-formed XML that lacks a top-level SVG root, such as documents with a non-SVG root or nested SVG elements. This cause the Sanitize...

EUVD-2026-110805

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540 svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540 svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace pass...

CVE-2026-117540

The svg-sanitizer library (versions 0.5.3 before 1.1.0 ) is vulnerable to a Denial of Service (DoS) attack within the Sanitizer::sanitize() function. The root cause is an inefficient algorithmic complexity issue where the software repeatedly rescans the entire input while stripping PHP tags. An u...

CVE-2026-117539

The darylldoyle svg-sanitizer (versions before 1.0.0 ) is vulnerable to CSS injection and remote reference bypass vulnerabilities. By uploading crafted SVG files, an attacker can embed external resources through unsanitized style content, unquoted url() values, or image href attributes. This may ...