High severity · published Oct 27, 2026
CVE-2026-117540
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
New
7.5
CVSS
–
EPSS
No
On KEV
Description
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
svg-sanitizer · darylldoyle
0.5.3 before 1.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117540
github.com
https://github.com/darylldoyle/svg-sanitizer/commit/9ba9001493f5da737759303f13bd965ebdaa778c
github.com
https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprp
www.vulncheck.com
https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-quadratic-cpu-exhaustion-dos-via-php-tag-stripping-loop
More from svg-sanitizer
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
6.5
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
5.3
CVE-2026-117541
svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
3.5
CVE-2026-117539
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass