CVE-2026-107381
1 advisory.
Packagist/enshrined/svg-sanitize CVE-2026-107381: medium 6.5
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Action: Upgrade enshrined/svg-sanitize to 1.0.0 or later.
composer require enshrined/svg-sanitize:1.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: GHSA-m9xh-6747-9r6f
- https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-m9xh-6747-9r6f
- https://github.com/darylldoyle/svg-sanitizer/commit/2dff6628314de8519155b7feb218bbe132785757
- https://github.com/darylldoyle/svg-sanitizer
- https://github.com/darylldoyle/svg-sanitizer/releases/tag/1.0.0
CVE-2026-107381 · published · modified · JSON