AIKIDO-2026-387398

TL;DR

The sanitizer validates href values after XML entity expansion, but the serialized output keeps the original entity reference while the DOCTYPE is stripped. A crafted DTD entity whose name collides with an HTML5 named character reference (for example 	) expands to a benign character during validation, so a javascript: URI passes the check. When the sanitized SVG is rendered inline in HTML, the browser resolves the named reference to U+0009, which URL parsers strip, exposing the javascript: scheme and running script. The fix strips the DOCTYPE/DTD before parsing so entity definitions never reach the parser.