CVE-2026-121443 in svg-sanitizer
Summary
by MITRE • 11/03/2026
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The svg-sanitizer library version 1.1.0 and earlier contains a critical denial of service vulnerability that stems from insufficient input validation when processing Scalable Vector Graphics files. This flaw allows remote attackers to cause application crashes or request failures by submitting malformed SVG content, specifically inputs that end within an unclosed tag structure. The core technical issue lies in the library's parsing logic which fails to handle edge cases where XML tags are truncated or incomplete before being fully processed. When such maliciously crafted input is submitted, it triggers uncaught exceptions during the internal validation routines, leading to a abrupt termination of the request handling process rather than graceful error recovery.
From a technical perspective, the vulnerability manifests when the parser encounters specific malformed structures that bypass standard length and syntax checks until late in the processing pipeline. In environments running PHP 8, this often results in an uncaught ValueError originating from functions such as strpos() within methods like hasElementWithTooManyAttributes or hasInternalDtdSubset. These internal helper functions are designed to enforce security constraints on SVG elements but lack robust exception handling for malformed input streams. Consequently, the application does not catch these errors, causing the web server script to terminate unexpectedly. Even in earlier PHP versions, similar logic flaws can lead to fatal errors or infinite loops depending on the specific implementation details of the parser's state machine when faced with truncated tags like a single less-than character which signals the start of an XML element but provides no closing delimiter.
The operational impact of this vulnerability is significant for any application that accepts user-uploaded SVG files and utilizes this library to sanitize them before storage or display. An attacker can exploit this by uploading a minimalistic yet malformed SVG file, such as one containing only a single opening angle bracket followed by invalid content or nothing at all. This action forces the server-side script into an error state, effectively denying service to legitimate users who are attempting to access the application's features that rely on successful request processing. In high-traffic environments, this can be leveraged for denial of service attacks where multiple concurrent requests with malformed SVG payloads consume significant CPU and memory resources while generating numerous errors, potentially degrading overall system performance or causing complete unavailability if not properly monitored and restarted by external process managers.
This vulnerability aligns with CWE-20 Improper Input Validation as the application fails to adequately validate input before processing it through complex parsing logic. It also relates to CWE-754 Improper Check for Unusual or Exceptional Conditions because the code does not handle unexpected error states resulting from malformed data structures. In terms of attack patterns, this falls under MITRE ATT&CK technique T1496 Resource Hijacking where an attacker uses limited resources to cause a denial of service by forcing the target system into inefficient processing paths or crashes. To mitigate this risk, developers should upgrade immediately to svg-sanitizer version 1.1.1 which addresses these parsing edge cases and implements proper exception handling for malformed SVG inputs. Additionally, implementing strict file size limits and validating SVG content against known safe schemas before passing them to the sanitizer can provide defense in depth. Ensuring that web servers are configured with appropriate error handling policies so that internal server errors do not expose stack traces or crash the entire worker process is also recommended to limit the blast radius of such exploitation attempts.