SB2026110655 - Multiple vulnerabilities in SVG Sanitizer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110655

SB2026110655 - Multiple vulnerabilities in SVG Sanitizer

Published: November 6, 2026

Security Bulletin ID SB2026110655
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 86% Low 14%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause CPU-exhaustion denial of service in applications using SVG Sanitizer.

The vulnerability exists due to quadratic processing in the default PHP-tag stripping loop, which repeatedly scans the entire input before XML parsing when overlapping PHP tags are supplied. An unauthenticated remote attacker can submit crafted SVG uploads without user interaction to occupy workers for tens of seconds and exhaust the worker pool through concurrent requests.


2) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause a denial of service in applications using SVG Sanitizer.

The vulnerability exists due to an uncaught exception during sanitization of well-formed XML that lacks a top-level SVG root element. An unauthenticated remote attacker can submit such XML to an application that passes untrusted input to the sanitizer without catching the exception, causing the request to terminate with a fatal error.


3) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications using SVG Sanitizer.

The vulnerability exists due to exponential path traversal in SVG Sanitizer's reference-graph analysis when layered, acyclic <use> references remain within the nesting limit but repeatedly traverse shared nodes. An unauthenticated remote attacker can submit a small crafted SVG for sanitization under default settings, causing excessive processing that occupies a PHP worker.


4) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications processing untrusted SVG files.

The vulnerability exists due to super-linear matching in SVG Sanitizer's CSS image-set regular expression when remote reference removal is enabled through removeRemoteReferences(true) and CSS contains repeated unterminated image-set tokens. An unauthenticated remote attacker can submit a crafted SVG under one megabyte to occupy a processing worker for tens of seconds.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute JavaScript in a victim's browser through stored cross-site scripting.

The vulnerability exists due to SVG Sanitizer's byte-based DOCTYPE stripping failing to recognize declarations in UTF-16 input with a byte order mark. An unauthenticated remote attacker can submit a crafted SVG containing DTD entities that preserve a JavaScript link through sanitization, triggering execution when the output is embedded inline in HTML and a victim clicks the link.


6) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to trigger requests to attacker-controlled external resources through a sanitized SVG.

The vulnerability exists due to incomplete filtering of CSS-escaped URLs in SVG Sanitizer when processing url() values in presentation attributes such as fill. An unauthenticated remote attacker can supply an SVG containing an escaped external URL that survives sanitization and triggers an outbound request when a victim opens it in Chrome.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Safari browser through cross-site scripting.

The vulnerability exists due to SVG Sanitizer failing to sanitize javascript: URLs in the values attribute of animateTransform elements that Safari permits to modify link destinations. An unauthenticated remote attacker can upload a crafted SVG file and trigger script execution when a victim using Safari clicks its link after the animation changes the destination.


Remediation

Install update from vendor's website.

References