Live › vulnerability › CVE-2026-121443
svg-sanitizer versions from 1.1.0 before 1.1.1 throw an uncaught ValueError when given SVG input that ends inside an unclosed tag, such as a single '<'. An attacker who can submit such input makes the request fail, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Applications that accept user-supplied SVG uploads or input and run them through svg-sanitizer on PHP 8 are exposed. Systems that never pass untrusted SVG to the library can skip it. The sources do not say whether the package is only used on PHP 8 in every case, only that the failing functions are reached on PHP 8.
No product ranges from the sources yet.
composer show enshrined/svg-sanitizer (package name unknown from sources; verify it)svg-sanitizer at a version below 1.1.1svg-sanitizer 1.1.1 (fixed version from the sources; earlier versions from are affected)1.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
This page as .md · .json · in your agent: get_signal("CVE-2026-121443")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.