Denial of Service Vulnerability in svg-sanitizer by Daryl Doyle
CVE-2026-121443

6.9MEDIUM

Key Information:

Vendor

Darylldoyle

Status
Svg-sanitizer
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121443?

The svg-sanitizer library versions prior to 1.1.1 are susceptible to a denial of service attack. Specifically, an attacker can craft SVG input that ends with an unclosed tag, leading to a crash during request processing. This triggers an uncaught ValueError in the PHP functions hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, resulting in failed requests. Users are advised to upgrade to version 1.1.1 or later to mitigate this risk.

Affected Version(s)

svg-sanitizer 1.1.0 < 1.1.1

svg-sanitizer 1.1.1

References

https://github.com/darylldoyle/svg-sanitizer/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/svg-sanitizer-from-1...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nlemoine
.