CVE-2026-121443 Details
Description
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
A denial-of-service vulnerability has been identified in svg-sanitizer versions 1.1.0 prior to 1.1.1. This vulnerability allows remote attackers to crash requests by submitting SVG input that ends inside an unclosed tag. On PHP 8, the 'sanitize()' function throws an uncaught ValueError when it encounters such input, disrupting the request. In contrast, PHP 7 handles the same situation by issuing a warning and returning false. The issue arises because the input can be truncated, such as by uploading a single '<' character, leading to an uncaught exception that fails the request.
Users can upgrade to svg-sanitizer version 1.1.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-f7cw-vfxq-7ph2 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/svg-sanitizer-from-1.1.0-before-1.1.1-denial-of-service-via-unclosed-tag | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| enshrined/svg-sanitize | >= 1.1.0, < 1.1.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |