CVE-2026-107380 Details
Description
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.
A stored cross-site scripting vulnerability has been identified in the Enshrined SVG Sanitizer library, specifically in versions through 0.22.0. The issue arises from improper handling of DTD entities during SVG sanitization, which allows for the injection of JavaScript URLs that are executed when the SVG is rendered inline. This vulnerability exploits a mismatch between XML and HTML5 entity resolution, bypassing the sanitizer's href validation and preserving a reference that later converts to an executable script link.
Users are advised to update to Enshrined SVG Sanitizer version 1.0.0, which removes the vulnerability by stripping the DOCTYPE before parsing, preventing custom entities from being defined and colliding with HTML5 Named Character References.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/darylldoyle/svg-sanitizer/commit/23877db7e76f1e1df5c3e65ab30239219c3d2867 | [email protected] | Source CodeVendor |
| https://github.com/darylldoyle/svg-sanitizer/releases/tag/1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-9rjx-3jch-6vjf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| darylldoyle svg-sanitizer | All versions |
CPE
Remediation
| |
| enshrined/svg-sanitize | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |