SV
Product
svg-sanitizer
6
CVEs
0
On KEV
7.5
Max CVSS
6
New 30D
Severity mix
Critical 0High 1Medium 4Low 1
Watch
Add svg-sanitizer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-117540 New | 7.5 | Oct 27 | svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop Affected: 0.5.3 before 1.1.0 |
| CVE-2026-107381 | 6.5 | Oct 14 | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences Affected: < 1.0.0 |
| CVE-2026-107379 | 6.5 | Oct 8 | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash Affected: < 1.0.0 |
| CVE-2026-107380 | 5.4 | Oct 8 | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision Affected: < 1.0.0 |
| CVE-2026-117541 New | 5.3 | Oct 27 | svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() Affected: 0.11.0 before 1.1.0 |
| CVE-2026-117539 New | 3.5 | Oct 27 | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass Affected: before 1.0.0 |
Showing 6