Medium severity · published Aug 12, 2025
CVE-2025-55166
svg-sanitizer By-Passing Attribute Sanitization
5.1
CVSS
0.5%
EPSS
No
On KEV
Description
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
svg-sanitizer · darylldoyle
< 0.22.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55166
github.com
https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
github.com
https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh
More from svg-sanitizer
7.5
CVE-2026-117540
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
6.5
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
5.3
CVE-2026-117541
svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()