{"schema":"threatline.record/2","record":{"id":"CVE-2026-107380","aliases":["GHSA-9rjx-3jch-6vjf"],"summary":"enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision","details":"## Summary\n\nA crafted SVG bypasses `enshrined/svg-sanitize`'s href validation and delivers a `javascript:` URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution (used during sanitization) and HTML5 Named Character Reference resolution (used by the browser when the SVG is rendered inline).\n\n**This is a logic bug in svg-sanitize. It does NOT depend on any PHP ext/dom bug — it works on any PHP version.**\n\n**Affected installations:**\n- **enshrined/svg-sanitize:** 45.2M Packagist downloads, 1.3M/month, 90+ dependents\n- **WordPress Safe SVG plugin:** 1M+ active installs (inline SVG rendering via themes)\n- **TYPO3, Drupal** and 90+ other Packagist dependents\n\n## Vulnerability Details\n\n### Mechanism\n\n1. Attacker defines a DTD entity whose name collides with an HTML5 Named Character Reference:\n ```xml\n \n ```\n In XML, ` ` expands to the literal string `\"#\"` (from the DTD definition).\n In HTML5, ` ` is a Named Character Reference that resolves to U+0009 (TAB character).\n\n2. The SVG uses this entity in an href:\n ```xml\n \n ```\n\n3. **During sanitization** (XML context): ` ` → `\"#\"` → the sanitizer sees `href=\"#javascript:alert(document.domain)\"` → starts with `#` → `isHrefSafeValue()` returns **TRUE** → passes through.\n\n4. **Sanitizer output:** `saveXML()` outputs the entity reference ` ` (not the expanded value), and strips the DOCTYPE declaration.\n\n5. **In the browser** (HTML5 context): Without the DOCTYPE, ` ` is resolved as the HTML5 Named Character Reference → U+0009 (TAB). The URL parser strips leading whitespace → `javascript:alert(document.domain)` **executes**.\n\n### Root Cause (Sanitizer.php)\n\n```php\n// isHrefSafeValue() — evaluates EXPANDED value (after XML entity resolution)\nprotected function isHrefSafeValue($value) {\n if ('#' === substr($value, 0, 1)) {\n return true; // Fragment identifier — \"safe\"\n }\n // ...\n}\n\n// But saveXML() preserves the entity REFERENCE, not the expanded value\n// And the DOCTYPE (which defines the entity) is stripped from output\n// → semantic mismatch between validation and output contexts\n```\n\n## Proof of Concept\n\n### Malicious SVG (xss.svg)\n\n```xml\n]>\n\n```\n\n### Sanitizer processing\n\n```php\nsanitize($svg);\necho $clean;\n```\n\n**Output:**\n```xml\n\n```\n\nThe `javascript:` href passes through the sanitizer. The DOCTYPE is stripped, but the ` ` entity reference is preserved.\n\n### Browser exploitation\n\nEmbed the sanitized SVG inline in HTML:\n```html\n

\n \n \n

\n```\n\n**Clicking the red rectangle executes `alert(document.domain)`.**\n\n**Confirmed:** Chrome 148. PoC file: `XSS_CONFIRMED_POC.html`\n\n### Exploitable Named Character References\n\nAny HTML5 Named Character Reference that expands to a URL-parser-ignored character:\n- ` ` → U+0009 (Horizontal Tab)\n- ` ` → U+000A (Line Feed)\n\nThese are stripped by the URL parser's scheme extraction, allowing `javascript:` to be the effective scheme.\n\n## Impact\n\n### Stored XSS\n\n- Attacker uploads SVG as Author (WordPress) or via any svg-sanitize-protected upload endpoint\n- SVG passes sanitization — sanitizer reports no issues\n- When SVG is rendered inline in HTML page, clicking the link executes JavaScript in the page's origin\n- **Account takeover:** `document.cookie`, `fetch('/wp-admin/...')`, session hijacking\n\n### Context requirement\n\nThe sanitized SVG must be embedded **inline in HTML** (not as `

`). Common scenarios:\n- WordPress themes that `echo file_get_contents($svg_path)` for inline SVG rendering\n- WordPress block editor SVG preview\n- Any web application rendering svg-sanitize output directly in HTML\n\nStandalone `