AIKIDO-2026-597685
enshrined/svg-sanitize is vulnerable to Denial of Service
65
Medium Risk
This Affects:
enshrined/svg-sanitizeTL;DR
The <use> reference graph is built with case-sensitive XPath that matches only @href or @xlink:href, so a mixed-case name such as xlink:HrEf is never added to the nesting-limit graph. A later pass normalizes the attribute back to xlink:href, leaving a live deeply nested <use> chain that the nesting-DoS protection should have removed. Processing such an SVG expands the nesting bomb and exhausts CPU and memory. The fix resolves href/xlink:href case-insensitively before the reference graph is built.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
enshrined/svg-sanitize is vulnerable to Denial of Service in versions 0.22.0 - 0.22.0.
How to fix this
Upgrade the enshrined/svg-sanitize library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.