CVE-2026-117541
Deferred Deferred - Pending Action

Uncaught Exception in svg-sanitizer Leading to Application Crash

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117541
EUVD
EUVD-2026-110806

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
darylldoyle svg-sanitizer 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncaught exception issue in the svg-sanitizer library versions 0.11.0 to 1.0.0. When processing well-formed XML without a top-level svg root element, the sanitize() method throws a LogicException instead of returning false as expected. Attackers can exploit this by submitting XML with no svg root, nested svg elements, or other root elements, causing crashes or denial-of-service conditions.

Detection Guidance

Check the installed version of svg-sanitizer with: composer show enshrined/svg-sanitizer. If the version is between 0.11.0 and 1.0.0, the system is vulnerable. Monitor logs for LogicException errors during SVG processing or application crashes when handling XML without an svg root.

Impact Analysis

This vulnerability can crash applications or worker processes handling SVG sanitization, bypass upload rejection mechanisms, and cause denial-of-service conditions. It may disrupt services relying on the svg-sanitizer library for processing SVG files.

Mitigation Strategies

Upgrade svg-sanitizer to version 1.1.0 or later immediately. If upgrading is not possible, implement input validation to reject XML documents without a top-level svg root before processing. Add exception handling to catch LogicException and return false instead of crashing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart