CVE-2026-117541

MediumCVSS 5.3/10Last modified Oct 27, 2026

Description

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
darylldoyle	svg-sanitizer	>= 0.11.0, < 1.1.0

References

Timeline

Published: Oct 27, 2026
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1175425.1Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could by CVE-2026-1175438.9Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external downl CVE-2026-1175448.2Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could refe CVE-2026-1175458.8IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentic CVE-2026-1175467.8Photoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-1175477.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-1175486.5A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema ali CVE-2026-1175494.2@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when CVE-2026-1175507.1Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters CVE-2026-11755110.0Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads a CVE-2026-1175537.5Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attac CVE-2026-1175544.3Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submit