CVE-2026-117540GHSA-2v7c-jx29-jprp
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
darylldoyle svg-sanitizer
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.1.0svg-sanitizerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
Text from CVE List
Affected versions 2
- svg-sanitizeraffected: 0.5.3 before 1.1.0CVE List
- svg-sanitizerunaffected: 1.1.0CVE List
References 3
- github.com/darylldoyle/svg-sanitizer/commit/9ba9001493f5da737759303f13bd965ebdaa778cFixvia CVE List
- github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprpAdvisoryvia CVE List
- vulncheck.com/advisories/svg-sanitizer-before-1.1.0-quadratic-cpu-exhaustion-dos-via-php-tag-stripping-loopAdvisoryvia CVE List