sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

Instatic-Stored-XSS-CVE-2026-103931

URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...

LOLLMS WebUI - Absolute Path Traversal

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...

Langflow <= 1.8.4 - Path Traversal to RCE via File Upload

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request. id: CVE-2026-5027 info: name: Langflow = 1.8.4 -...

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

DrupalCVE-2018-7602

Drupal Remote Code Execution Vulnerability CVE-2018-7602 Affected software: drupal Method: Encode the in the URL twice to bypass the sanitize function filtering Effect: Arbitrary command execution Vulnerability Environment Execute the following command to start the drupal 7.57 environment:...

CLSA-2026-1791988717 TuxCare security update for enshrined/svg-sanitize (3 CVEs)

TuxCare rebuilt enshrined/svg-sanitize to address 3 CVEs. Fixed in 0.16.0-p2+tuxcare...

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

GHSA-9RJX-3JCH-6VJF enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

GHSA-V383-3RW5-Q8RF enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

PT-2026-108127

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A logic error exists in the way SVG href values are validated. The isHrefSafeValue function validates the SVG href after XML DTD entity expansion, but the saveXML function serializes t...

PT-2026-108126

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A flaw exists in the cleanAttributesOnWhitelist function within src/Sanitizer.php where the software fails to strip DOCTYPE/DTD declarations before processing. An attacker can provide ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fixed an out-of-bounds read in cifssanitizeprepath. When cifssanitizeprepath is called with an empty string or a string containing only delimiters e.g., /, the current logic attempts to check cursor2 - 1 before...

Astra Linux – Vulnerability in node-moment

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability affects users of Moment.js on npm server versions between 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch the moment locale...

PT-2026-103099

Name of the Vulnerable Software and Affected Versions ReactPress – Create React App for WordPress versions prior to 3.4.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can...

GO-2026-6542 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...