Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

enshrined/svg-sanitize

7 known vulnerabilities (5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 5 medium
Registry
Packagist

Advisories 7

  • CVE-2026-107381Medium 6.5

    svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

    Affected: fixed in 1.0.0.

  • CVE-2026-107380Medium 5.4

    enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

    Affected: fixed in 1.0.0.

  • CVE-2026-107379Medium 6.5

    enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

    Affected: fixed in 1.0.0.

  • CVE-2025-55166Medium 5.1

    svg-sanitizer By-Passing Attribute Sanitization

    Affected: fixed in 0.22.0.

  • CVE-2022-23638Medium 6.2

    Cross-site Scripting in svg-sanitizer

    Affected: fixed in 0.15.0.

  • It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace…

    Affected: fixed in 0.13.1.

  • darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as…

    Affected: fixed in 0.12.0.