AIKIDO-2026-10552

TL;DR

The sanitizer loads untrusted SVG, HTML, or MathML with loadDocument through loadXML or loadHTML. Before the change, the parser could process document types and entity declarations and resolve external entities where the platform allows it, which can lead to local file or network fetches and to entity expansion that exhausts memory. The update strips doctype and entity declaration syntax from the string before parsing, passes LIBXML_NONET so the load path cannot open remote DTDs or resources, and on older PHP runtime versions temporarily disables Libxml’s external entity loader around the parse.