GHSA-94x8-pw3c-6qcq: svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
svg-sanitizerto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
svg-sanitizer versions from 1.0.0 before 1.1.0 are affected when removeRemoteReferences is enabled.
What does an attacker need to exploit this issue?
An attacker needs to be able to submit an SVG containing many unclosed image-set tokens. No authentication or user interaction is indicated by the provided severity vector.
What is the practical impact of a failed sanitization?
Malformed input can exhaust CPU through regular-expression processing. It can also trigger PCRE limits, causing sanitize() to throw a TypeError and leave content unsanitized.
What version should be used to address the issue?
Upgrade to svg-sanitizer 1.1.0 or later.