{"id":"CVE-2026-121444","kind":"vulnerability","aliases":["CVE-2026-121444"],"related":[],"title":"svg-sanitizer: crafted SVG pins PHP workers for hours","description":"svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.","summary":"svg-sanitizer, a PHP library for cleaning SVG uploads, takes exponential time on a small crafted SVG with layered use elements. An attacker who can upload a file can tie up PHP workers for hours, causing denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","package","php","svg-upload"],"not_affected_if":["no-svg-uploads","trusted-input-only"],"how_to_check":"- Look for `svg-sanitizer` in `composer.lock` or `composer show svg-sanitizer`\n- Check whether the installed version is between `0.11.0` and `1.1.0` (before `1.1.0`)","fix":"- Move to `svg-sanitizer` `1.1.0` or later","status":"open","published_at":"2026-11-03T15:17:36+00:00","first_seen_at":"2026-11-03T15:22:00+00:00","triaged_at":"2026-11-03T15:22:33+00:00","updated_at":"2026-11-03T15:22:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:22:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `svg-sanitizer` `1.1.0` or later","reach":"internet","title":"svg-sanitizer: crafted SVG pins PHP workers for hours","impact":"low","summary":"svg-sanitizer, a PHP library for cleaning SVG uploads, takes exponential time on a small crafted SVG with layered use elements. An attacker who can upload a file can tie up PHP workers for hours, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","svg-upload","composer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"PHP workers are pinned for hours, causing denial of service","analyst_note":"","how_to_check":"- Look for `svg-sanitizer` in `composer.lock` or `composer show svg-sanitizer`\n- Check whether the installed version is between `0.11.0` and `1.1.0` (before `1.1.0`)","plain_action":"","needs_analyst":false,"not_affected_if":["no-svg-uploads","trusted-input-only"],"who_is_affected":"Applications that pass user-uploaded SVG files through svg-sanitizer on PHP workers are exposed, because the crafted input is processed during the upload. Systems that never accept SVG uploads, or that do not run this library on untrusted input, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4198,"output_tokens":510,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121444':13A,16A '-2026':12A,15A '0.11.0':67C '1.1.0':69C '15':97C 'algorithm':72C 'analysi':88C 'attack':46B,89C 'caus':59B 'clean':30B 'complex':73C 'compos':17B 'contain':70C 'countus':81C 'craft':4A,39B 'cve':11A,14A 'denial':60B,74C 'element':44B,104C 'enumer':108C 'exponenti':34B,106C 'fan':101C 'fanned-out':100C 'file':51B 'forc':105C 'graph':87C 'hasinfiniteloop':79C 'hour':10A,58B,114C 'layer':42B,94C 'level':98C 'librari':28B 'packag':18B 'path':107C 'php':7A,19B,27B,55B,111C 'pin':6A,110C 'refer':86C 'reference-graph':85C 'sanit':3A,25B,65C 'servic':62B,76C 'small':38B,93C 'svg':2A,5A,21B,24B,31B,40B,64C,95C 'svg-sanit':1A,23B,63C 'svg-upload':20B 'take':33B 'tie':53B 'time':35B 'upload':22B,32B,49B,91C 'use':43B,84C,103C 'vulner':77C 'worker':8A,56B,112C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass user-uploaded SVG files through svg-sanitizer on PHP workers are exposed, because the crafted input is processed during the upload. Systems that never accept SVG uploads, or that do not run this library on untrusted input, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["composer","high","package","php","svgupload"],"first_public_at":"2026-10-19T12:09:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121444","severity":null,"published_at":"2026-11-03T15:17:36+00:00","modified_at":"2026-11-03T15:17:36+00:00","first_seen_at":"2026-11-03T15:22:00+00:00","fetched_at":"2026-11-03T15:22:00+00:00","note":null}],"documents":[{"id":58415,"url":"https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:09:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58416,"url":"https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}