Svg Sanitizer
Approved changes feed: RSS · Atom
cpe:2.3:a:svg-sanitizer_project:svg-sanitizer:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Svg Sanitizer Project (45cd2e57-75e7-5a3c-b232-43c616fd4941) |
|---|---|
| Product | Svg Sanitizer (c8ebb9b5-2535-5def-9b45-f551992d8237) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/darylldoyle/svg-sanitizer |
purl2cpe | 2026-06-01 10:15:08.422975 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-117539 |
vulnerable | 2026-11-03 10:15:34.289783 |
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
LOW (3.5)
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
Published: 2026-10-27T10:59:33.466Z
Updated: 2026-11-02T15:51:40.586Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-117541 |
vulnerable | 2026-11-03 10:15:33.614222 |
svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
MEDIUM (5.3)
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
Published: 2026-10-27T10:59:34.783Z
Updated: 2026-10-27T14:12:13.476Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-117540 |
vulnerable | 2026-11-03 10:15:33.500845 |
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
HIGH (7.5)
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
Published: 2026-10-27T10:59:34.119Z
Updated: 2026-11-02T19:11:08.157Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23638 |
vulnerable | 2026-06-08 05:40:58.091919 |
Cross-site Scripting in svg-sanitizer
MEDIUM (6.2)
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
Published: 2022-02-14T21:10:10.000Z
Updated: 2025-04-23T19:05:21.988Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-18857 |
vulnerable | 2026-06-08 05:13:12.447110 |
Details available
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	:alert substring.
Published: 2019-11-11T14:34:59.000Z
Updated: 2024-08-05T02:02:39.688Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10772 |
vulnerable | 2026-06-08 05:12:25.267092 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.