CVE-2026-107381

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS via SVG Sanitizer Reference Handling

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: GitHub, Inc.

Description

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107381

EUVD

EUVD-2026-101125

Affected Vendors & Products

Vendor	Product	Version / Range
darylldoyle	svg-sanitizer	< 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in svg-sanitizer (versions 0.22.0 and earlier) involves a case-sensitive href matching flaw in the processing of SVG <use> elements. The Resolver::processReferences() function builds a reference graph using case-sensitive XPath queries, missing mixed-case attributes like xlink:HrEf. Later, cleanHrefAttributes() normalizes these to canonical form, bypassing nesting-DoS protection. This allows attackers to submit SVGs with mixed-case href attributes that bypass sanitization, creating nesting bombs that cause resource exhaustion.

Detection Guidance

To detect this vulnerability, inspect SVG files for mixed-case href attributes like xlink:HrEf or HrEf in <use> elements. Use commands to search for such patterns in uploaded or processed SVGs. For example, grep for mixed-case href variants in directories containing user-uploaded files: grep -r 'xlink:HrEf\|HrEf' /path/to/svgs/ or check sanitizer logs for unprocessed nested <use> elements. Upgrade svg-sanitizer to version 1.0.0 or later to mitigate the issue.

Impact Analysis

If you use svg-sanitizer to process user-uploaded SVGs, an attacker could exploit this to create a nesting bomb (malicious SVG with deeply nested <use> elements). This could exhaust system resources like CPU or memory, leading to denial of service or application crashes. The vulnerability requires no special privileges, making it accessible to any attacker who can submit an SVG file.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by enabling resource exhaustion attacks through malicious SVG files. If an application processes user-uploaded SVGs without proper sanitization, attackers could exploit this flaw to consume excessive system resources, potentially leading to service disruptions or denial of service. This may violate availability requirements in GDPR (data integrity) and HIPAA (system availability).

Mitigation Strategies

Update svg-sanitizer to version 1.0.0 or later to address the case-sensitive href handling issue in Resolver::processReferences().

Review SVG files processed by the sanitizer for mixed-case href attributes like xlink:HrEf which may bypass nesting-DoS protection.

Hi! I’m here to help you understand CVE-2026-107381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70