CVE-2026-121443Medium· 5.3▾ Sunlitsvg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<'…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
svg-sanitizer >= 1.1.0 < 1.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117541Medium· 5.3svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()
CVE-2026-121444High· 7.5svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
CVE-2026-121445Medium· 5.9svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping
CVE-2026-121447Medium· 6.1svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
CVE-2026-121446Medium· 4.3svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
CVE-2026-117539Low· 3.5darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass