Uncaught Exception in svg-sanitizer Affects Software by Daryl Doyle
CVE-2026-117541

6.9MEDIUM

Key Information:

Vendor

Darylldoyle

Status
Svg-sanitizer
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117541?

The svg-sanitizer library, version 0.11.0 and prior, has a vulnerability that permits attackers to crash applications by utilizing well-formed XML files that lack a top-level svg root element. Submitting documents with either a non-svg root or nested svg elements can trigger a LogicException in the Sanitizer::sanitize() method, leading to application crashes or evasion of upload restrictions. Proper handling of such cases is crucial to maintaining the integrity and uptime of services relying on this library.

Affected Version(s)

svg-sanitizer 0.11.0 < 1.1.0

svg-sanitizer 1.1.0

References

https://github.com/darylldoyle/svg-sanitizer/security/adv...
vendor-advisory
https://github.com/darylldoyle/svg-sanitizer/commit/9ba90...
patch
https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.