# enshrined/svg-sanitize (Packagist) vulnerabilities 7 known vulnerabilities (5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/enshrined/svg-sanitize ## Advisories (7) ### [CVE-2026-107381](https://cve.now/CVE-2026-107381): svg-sanitizer: Mixed-case xlink:HrEf skips the \`\\` nesting-DoS check in Resolver::processReferences - Severity: Medium 6.5 - Published: Oct 14, 2026 - Affected: fixed in 1.0.0. ### [CVE-2026-107380](https://cve.now/CVE-2026-107380): enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision - Severity: Medium 5.4 - Published: Oct 8, 2026 - Affected: fixed in 1.0.0. ### [CVE-2026-107379](https://cve.now/CVE-2026-107379): enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash - Severity: Medium 6.5 - Published: Oct 8, 2026 - Affected: fixed in 1.0.0. ### [CVE-2025-55166](https://cve.now/CVE-2025-55166): svg-sanitizer By-Passing Attribute Sanitization - Severity: Medium 5.1 - Published: Aug 12, 2025 - Affected: fixed in 0.22.0. ### [CVE-2022-23638](https://cve.now/CVE-2022-23638): Cross-site Scripting in svg-sanitizer - Severity: Medium 6.2 - Published: Feb 14, 2022 - Affected: fixed in 0.15.0. ### [CVE-2019-10772](https://cve.now/CVE-2019-10772): It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace… - Severity: Unrated - Published: Dec 11, 2019 - Affected: fixed in 0.13.1. ### [CVE-2019-18857](https://cve.now/CVE-2019-18857): darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as… - Severity: Unrated - Published: Nov 11, 2019 - Affected: fixed in 0.12.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/enshrined/svg-sanitize Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.