CVE-2026-120218

A stored cross-site scripting (XSS) vulnerability exists in TypeMill versions 2.6.0 through 2.26.0 within the SvgSanitizer component. The root cause is that the sanitizer uses DOMDocument::getElementsByTagName("*") to filter XML elements, which fails to detect and remove XML processing instructio...