CVE-2026-107381

MediumCVSS 6.5/10Last modified Oct 18, 2026

Description

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-178CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
darylldoylesvg-sanitizer< 1.0.0

References

Timeline

Published
Oct 14, 2026
Last modified
Oct 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1073825.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zCVE-2026-1073837.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7,CVE-2026-1073848.1MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4CVE-2026-1073857.4MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7,CVE-2026-1073866.3amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassedCVE-2026-1073875.5music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-iteCVE-2026-1073885.5music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field aCVE-2026-1073895.5music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attackerCVE-2026-107398.5Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validatCVE-2026-1073907.5music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit CVE-2026-1073917.5music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a developmCVE-2026-1073927.5music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calli