AIKIDO-2026-531171
enshrined/svg-sanitize is vulnerable to Denial of Service
65
Medium Risk
This Affects:
enshrined/svg-sanitizeTL;DR
The cleanAttributesOnWhitelist() method can call DOMElement::removeAttribute() twice for the same attribute name in a single iteration. When a DTD #FIXED default attribute is present, the second removal targets the DTD declaration node and triggers a libxml type confusion that raises SIGABRT and kills the PHP process. A small crafted SVG carrying such a #FIXED attribute crashes any worker that sanitizes it. The fix strips the DOCTYPE/DTD before parsing and skips further checks once an attribute is removed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
enshrined/svg-sanitize is vulnerable to Denial of Service in versions 0.13.0 - 0.22.0.
How to fix this
Upgrade the enshrined/svg-sanitize library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.