Packagist/enshrined/svg-sanitize CVE-2025-55166: medium 5.1, EPSS 0.51%

svg-sanitizer Bypasses Attribute Sanitization

Action: Upgrade enshrined/svg-sanitize to 0.22.0 or later.

composer require enshrined/svg-sanitize:0.22.0

Affected

Fixed versions

Sources

• osv: GHSA-22wq-q86m-83fh
• nvd: CVE-2025-55166
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh
• https://github.com/darylldoyle/svg-sanitizer/commit/0afa95ea74be155a7bcd6c6fb60c276c39984500
• https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
• https://github.com/darylldoyle/svg-sanitizer
• https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481
• https://github.com/darylldoyle/svg-sanitizer/releases/tag/0.22.0

CVE-2025-55166 · published 2025-08-12T20:20:58Z · modified 2025-08-12T20:42:20.247581Z · JSON