CVE-2026-107380 in svg-sanitizer
Summary
by MITRE • 10/08/2026
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in savg-sanitizer prior to version 1.0.0 represents a critical bypass of security controls through inconsistent handling of XML entity expansion and serialization, specifically affecting SVG href attribute sanitization. The core technical flaw lies in the discrepancy between how the sanitizer validates input data versus how it outputs that same data after processing. During the validation phase, the isHrefSafeValue function processes the SVG href by first expanding any XML DTD entities present within the string. This expansion resolves entity references into their actual character values, allowing the sanitizer to evaluate the resulting plain text against a whitelist of safe prefixes or patterns. However, during the serialization phase via saveXML(), the library removes the DTD declaration but fails to replace the original entity reference nodes with their expanded counterparts. Instead, it serializes the raw, unexpanded entity references back into the output string. This creates a state where the content validated as safe by the sanitizer differs materially from the content actually written to the document structure.
This architectural inconsistency leads directly to an HTML5 Named Character Reference resolution issue when the sanitized SVG is embedded inline within an HTML page. Modern browsers, particularly those adhering to HTML5 standards for inline SVG rendering, perform additional parsing steps on character references found in attributes such as href. When a crafted entity like Tab (represented by 	 or similar numeric/hexadecimal entities) survives this process, the browser interprets it according to HTML5 rules during the final render phase. In many contexts, certain whitespace characters including tabs are treated equivalently to spaces or other whitespace that can be stripped from URL schemes for security checks. Consequently, a javascript: URL prefixed with such an entity reference appears as safe because the leading whitespace is ignored by the browser's scheme detection logic, effectively stripping away the protective prefix and exposing the malicious script execution vector.
The operational impact of this vulnerability is severe, enabling Cross-Site Scripting (XSS) attacks against users who interact with applications that embed sanitized SVG content inline. An attacker can craft a specific SVG payload containing an entity reference designed to bypass the sanitizer's checks while still resolving to whitespace in the browser environment. When a victim activates a link within this maliciously crafted SVG, such as by clicking on it or triggering its href attribute through user interaction, the embedded script executes with the privileges of the embedding page's origin. This allows for potential session hijacking, credential theft, defacement, or further exploitation depending on the sensitivity of data accessible to the victim's browser context at that time. The attack vector is particularly insidious because it relies on a subtle parsing difference between server-side sanitization logic and client-side rendering behavior, making it difficult to detect through standard static analysis without deep understanding of XML entity handling nuances.
From an industry standards perspective, this vulnerability aligns with CWE-830: Inclusion of Functionality from Untrusted Control Sector, as the application trusts input that has been processed in a way that diverges from its final rendered state. It also relates to CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), specifically involving encoded or entity-based bypasses. In terms of MITRE ATT&CK mapping, this technique falls under T1059.006: HTML/JS Injection via SVG elements and potentially T1189: Drive-by Compromise if the payload is delivered through a compromised website. The root cause can be classified as CWE-20: Improper Input Validation where the validation logic does not account for post-validation transformations performed by downstream parsers, such as browser-based HTML5 entity resolution.
Mitigation strategies primarily involve upgrading to version 1.0.0 of savg-sanitizer or any subsequent patched release that corrects this serialization inconsistency. Developers should ensure that their sanitization libraries maintain consistency between validation and output phases, ensuring that expanded entities are serialized rather than raw references when the DTD is stripped. Additionally, implementing Content Security Policy (CSP) headers can provide a layer of defense-in-depth by restricting script execution sources, thereby mitigating the impact even if such bypasses occur in other parts of an application stack. Regular security audits focusing on XML/HTML entity handling and cross-browser rendering differences are recommended to identify similar discrepancies in custom sanitization logic or third-party libraries used for content processing.