CVE-2026-121443
Deferred Deferred - Pending Action

Denial of Service in svg-sanitizer via Truncated SVG Input

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121443
EUVD
EUVD-2026-115865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
darylldoyle svg-sanitizer 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in the svg-sanitizer library affecting versions 1.1.0 to 1.1.0. It allows remote attackers to crash applications by submitting SVG input with an unclosed tag. A single '<' character can trigger an uncaught ValueError in specific functions on PHP 8, causing the request to fail.

Detection Guidance

Check the installed version of svg-sanitizer with: composer show enshrined/svg-sanitize. If the version is 1.1.0 or below, the system is vulnerable. Test with a single '<' character input to see if it triggers an uncaught exception or request failure.

Impact Analysis

The vulnerability can cause application crashes or request failures when processing untrusted SVG input. Systems using PHP 8 with default settings are particularly affected. On PHP 7, it may raise warnings but could still cause issues if warnings are treated as errors.

Mitigation Strategies

Upgrade svg-sanitizer to version 1.1.1 or later immediately. If upgrading is not possible, implement input validation to reject truncated or malformed SVG inputs before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...