GHSA-f7cw-vfxq-7ph2: svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using svg-sanitizer version 1.1.0 are affected if they process attacker-controlled SVG input. The issue is triggered on PHP 8.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs a way to submit SVG content to the application. A truncated SVG ending within an unclosed tag, including a single '<' character, can cause request processing to fail.
What is the impact of successful exploitation?
The malformed input triggers an uncaught ValueError in strpos() during sanitizer checks, causing the affected request to crash. The provided impact data indicates availability impact only.