CVE-2026-121445

The svg-sanitizer library (versions 1.0.0 before 1.1.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) and a fail-open condition. The flaw exists in the image-set pattern within the stripRemoteCssTokens() function when removeRemoteReferences is enabled. An attacker can provide S...