CVE-2026-121443

MediumCVSS 5.3/10Last modified Nov 9, 2026

Description

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1214447.5svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse(CVE-2026-1214455.9darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of CVE-2026-1214464.3svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by u CVE-2026-1214476.1svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript:CVE-2026-1214488.3Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files out CVE-2026-1214496.5Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as re CVE-2026-1214507.5CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin passwo CVE-2026-1214518.8AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that al CVE-2026-1214526.5bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP tr CVE-2026-1214532.7SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators CVE-2026-1214543.7Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to CVE-2026-1214555.4DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PER