CVE-2026-103087: High severity Gosub gosub-engine vulnerability
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.
Affected Software
Event History
Frequently Asked Questions
What attacker interaction is required to trigger the denial of service?
An attacker must persuade the victim to visit an attacker-controlled web page. The page can embed a malicious SVG in the SRC attribute of an IMG element, causing the engine to render it.
Which deployments are exposed?
Deployments using gosub-engine through version 0.1.0, or builds from main before commit 46868b3, are affected when they render attacker-supplied or attacker-controlled SVG content.
What is the impact once the malicious SVG is rendered?
Excessive SVG element nesting causes uncontrolled recursion while processing SVG nodes. This exhausts the thread stack and terminates the application.