CVE-2026-117541: svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using svg-sanitizer versions from 0.11.0 up to, but not including, 1.1.0 are affected if untrusted users can submit XML documents to Sanitizer::sanitize().
What input is needed to trigger the failure?
An attacker can submit well-formed XML that lacks a top-level svg root, including a document with a non-svg root element or a nested svg element. No authentication or user interaction is required according to the supplied vector.
What is the practical impact on an application?
Sanitizer::sanitize() throws an uncaught LogicException rather than returning false. This can crash the calling worker or cause the application to bypass its intended upload-rejection handling.
How can I determine whether my application is affected?
Check whether it uses an affected svg-sanitizer version and whether sanitize() is called on attacker-controlled uploads or XML. Test the caller's error handling with well-formed XML whose root is not svg, or with an svg element nested beneath another root.