Live › vulnerability › CVE-2026-117541
Go to dashboardThe svg-sanitizer library throws a LogicException from Sanitizer::sanitize() when given well-formed XML without a top-level svg root, instead of returning false. An attacker can submit such a file to crash the calling process or skip the upload rejection check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Applications that accept user-uploaded SVG files and pass them through svg-sanitizer from 0.11.0 up to but not including 1.1.0. Exposure depends on whether the upload endpoint is reachable by untrusted users and whether a thrown exception takes down the worker or skips the rejection branch. Teams that do not sanitize user SVGs with this library can skip it.
No product ranges from the sources yet.
composer show enshrined/svg-sanitizer (or check composer.lock) and see whether the installed version is at least 1.1.0Sanitizer::sanitize( and check whether they catch exceptions around them1.1.0 or laterSanitizer::sanitize() calls in a try/catch and treat exceptions as rejected uploadsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
This page as .md · .json · in your agent: get_signal("CVE-2026-117541")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.