CVE-2026-107380
1 advisory.
Packagist/enshrined/svg-sanitize CVE-2026-107380: medium 5.4, EPSS 0.21%
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Action: Upgrade enshrined/svg-sanitize to 1.0.0 or later.
composer require enshrined/svg-sanitize:1.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: GHSA-9rjx-3jch-6vjf
- https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-9rjx-3jch-6vjf
- https://nvd.nist.gov/vuln/detail/CVE-2026-107380
- https://github.com/darylldoyle/svg-sanitizer/commit/23877db7e76f1e1df5c3e65ab30239219c3d2867
- https://github.com/darylldoyle/svg-sanitizer
- https://github.com/darylldoyle/svg-sanitizer/releases/tag/1.0.0
CVE-2026-107380 · published · modified · JSON