CVE-2026-117539Low· 3.5▾ Sunlitdarylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.
svg-sanitizer < 1.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107380Medium· 5.4savg-sanitizer is a PHP SVG/XML sanitizer
CVE-2026-117541Medium· 5.3svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
CVE-2026-117540High· 7.5svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
CVE-2026-107379Medium· 6.5savg-sanitizer is a PHP SVG/XML sanitizer
CVE-2021-41164High· 8.2CKEditor4 is an open source WYSIWYG HTML editor
CVE-2021-41183Medium· 6.5jQuery-UI is the official jQuery user interface library