CVE-2026-117540 in svg-sanitizer
Summary
by MITRE • 10/27/2026
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The svg-sanitizer library, specifically versions prior to 1.1.0 released after version 0.5.3, contains a critical denial of service vulnerability within its core sanitization logic. This flaw resides in the Sanitizer::sanitize() method, which is responsible for processing and cleaning SVG files by removing potentially dangerous content such as PHP tags. The underlying technical issue stems from an inefficient algorithmic approach to pattern matching and replacement. When the sanitizer encounters input containing numerous overlapping or closely spaced PHP tag openers and closers, it triggers a recursive rescanning mechanism that processes the entire input string repeatedly rather than performing a single linear pass. This design flaw results in quadratic time complexity relative to the size of the malicious payload, meaning that as the number of tags increases, the processing time grows exponentially rather than linearly.
From an operational perspective, this vulnerability allows unauthenticated attackers to craft specific SVG files designed to exploit this inefficiency. By uploading an SVG file containing a high volume of overlapping PHP tag markers, an attacker can force the server-side application to execute thousands or millions of preg_replace operations in rapid succession. This computational exhaustion consumes significant CPU resources on the worker process handling the request. The impact is severe as it leads to prolonged unresponsiveness for that specific worker thread, potentially blocking other legitimate requests if the system relies on a limited pool of workers. In worst-case scenarios, this can lead to a complete service outage or degraded performance across the entire application infrastructure due to resource starvation caused by these maliciously crafted inputs.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-400: Uncontrolled Resource Consumption and CWE-789: Memory Exclusion Based on Input Size, highlighting the failure of the library to properly bound computational effort based on input characteristics. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of techniques related to Impact via Service Disruption or Denial of Service, where an adversary leverages application logic flaws to degrade availability without necessarily gaining unauthorized access to data. The lack of proper bounds checking and efficient parsing strategies allows for a straightforward exploitation path that does not require authentication, making it particularly dangerous in public-facing applications that accept user-uploaded SVG content.
To mitigate this risk, organizations must immediately upgrade the svg-sanitizer library to version 1.1.0 or later, where the underlying algorithm has been optimized to prevent quadratic rescanning and ensure linear processing time regardless of input complexity. For systems unable to update immediately due to dependency constraints, implementing strict file size limits on uploaded SVGs can reduce the effectiveness of the attack by limiting the maximum number of tags an attacker can include in a single request. Additionally, deploying Web Application Firewalls with rules that detect patterns indicative of this specific abuse vector may provide a layer of defense against such resource exhaustion attempts until the software patch is fully deployed across all affected environments.