Medium severity · published Oct 27, 2026
CVE-2026-117541
svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
New
5.3
CVSS
–
EPSS
No
On KEV
Description
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
svg-sanitizer · darylldoyle
0.11.0 before 1.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117541
github.com
https://github.com/darylldoyle/svg-sanitizer/commit/9ba9001493f5da737759303f13bd965ebdaa778c
github.com
https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-cgcm-4g72-hfgw
www.vulncheck.com
https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-uncaught-logicexception-dos-via-sanitize
More from svg-sanitizer
7.5
CVE-2026-117540
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
6.5
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
3.5
CVE-2026-117539
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass