What’s Vulnerable › Vulnerabilities

CVE-2026-117541: svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-27
• Weakness: CWE-248

Description

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.

Affected products

• darylldoyle svg-sanitizer: from 0.11.0 before 1.1.0 — fixed in 1.1.0

How to fix

Upgrade to a fixed version: darylldoyle svg-sanitizer 1.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/darylldoyle/svg-sanitizer/commit/9ba9001493f5da737759303f13bd965ebdaa778c
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-cgcm-4g72-hfgw
• https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-uncaught-logicexception-dos-via-sanitize

Get alerted when CVE-2026-117541 or the next vulnerability affects your stack