CLSA-2026-1791988717 TuxCare security update for enshrined/svg-sanitize (3 CVEs)

TuxCare rebuilt enshrined/svg-sanitize to address 3 CVEs. Fixed in 0.16.0-p2+tuxcare...

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

GHSA-9RJX-3JCH-6VJF enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

GHSA-V383-3RW5-Q8RF enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

PT-2026-108126

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A flaw exists in the cleanAttributesOnWhitelist function within src/Sanitizer.php where the software fails to strip DOCTYPE/DTD declarations before processing. An attacker can provide ...

PT-2026-108127

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A logic error exists in the way SVG href values are validated. The isHrefSafeValue function validates the SVG href after XML DTD entity expansion, but the saveXML function serializes t...

ROOT-APP-COMPOSER-AIKIDO-2026-387398 AIKIDO-2026-387398 in enshrined/svg-sanitize - Patched by Root

Root has patched AIKIDO-2026-387398 in the enshrined/svg-sanitize package for Root:Composer. Multiple fixed versions available...

PT-2026-105927

Root has patched AIKIDO-2026-387398 in the enshrined/svg-sanitize package for Root:Composer. Multiple fixed versions available...

CLSA-2026-1787820940 TuxCare security update for enshrined/svg-sanitize (1 CVE)

TuxCare rebuilt enshrined/svg-sanitize to address 1 CVE. Fixed in 0.16.0-p1+tuxcare...

PT-2026-86540

TuxCare rebuilt enshrined/svg-sanitize to address 1 CVE. Fixed in 0.16.0-p1+tuxcare...

EUVD-2020-0296

Malware in sbrugna...

CVE-2019-10772

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer...

PT-2022-38347

SVG Formatter module provides support for using SVG images on your website. Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images...

FreeBSD : typo3 -- XSS vulnerability in svg-sanitize (0eab001a-9708-11ec-96c9-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0eab001a-9708-11ec-96c9-589cfc0f81b0 advisory. - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all...

typo3 -- XSS vulnerability in svg-sanitize

The TYPO3 project reports: The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+x...

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...

GHSA-GF8J-V8X5-H9QP XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...