What’s Vulnerable › Products

darylldoyle svg-sanitizer vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your darylldoyle svg-sanitizer version is affected

Latest darylldoyle svg-sanitizer vulnerabilities

• CVE-2026-117541 — svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() (CVSS 5.3)
• CVE-2026-117540 — svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop (CVSS 7.5)
• CVE-2026-117539 — darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass (CVSS 3.5)
• CVE-2026-107381 — svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (CVSS 6.5)
• CVE-2026-107380 — enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (CVSS 5.4)
• CVE-2026-107379 — enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash (CVSS 6.5)
• CVE-2025-55166 — svg-sanitizer By-Passing Attribute Sanitization (CVSS 5.1)
• CVE-2022-23638 — Cross-site Scripting in svg-sanitizer (CVSS 6.1)
• CVE-2019-10772 — (CVSS 6.1)
• CVE-2019-18857 — (CVSS 7.5)