CVE-2026-117540: svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic pregreplace passes that exhaust worker CPU for minutes.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using svg-sanitizer versions 0.5.3 through versions before 1.1.0 are affected when they accept attacker-controlled SVG input and pass it to Sanitizer::sanitize().
What does an attacker need to exploit this issue?
An attacker needs to be able to submit or upload a crafted SVG for sanitization. No authentication or user interaction is required.
What is the impact of successful exploitation?
Crafted SVG content can cause repeated full-input processing and consume worker CPU for minutes, resulting in denial of service. The provided impact information indicates availability impact only, with no confidentiality or integrity impact.
What should be done to remediate the issue?
Upgrade svg-sanitizer to version 1.1.0 or later. The vulnerable versions are 0.5.3 through versions before 1.1.0.