AIKIDO-2026-806370
enshrined/svg-sanitize is vulnerable to Uncontrolled Resource Consumption
87
CVE Score
High
Uncontrolled Resource Consumption
TL;DR
Before the fix, sanitize() walked the <use> reference graph once per path: Subject::hasInfiniteLoop() and countUse() recursed with only an on-path cycle check, plus a depth cap of 15, but no memoization. Anyone who could submit an SVG for sanitizing, such as an unauthenticated upload, could send a few KB of layered <use> references fanning out at depth 15, and the exponential path enumeration pinned a PHP worker for hours with default settings. The fix memoizes proven loop-free subjects and use counts, so each subject is walked once and the work stays linear.
How do I fix this?
Upgrade the enshrined/svg-sanitize package to 1.1.0 or later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and sanitize SVG documents supplied by users or unauthenticated clients whose id'd elements reference each other through <use>.
Package
Versions
0.11.0 - 1.0.0
Fixed in 1.1.0Background info
enshrined/svg-sanitize is vulnerable to Uncontrolled Resource Consumption in versions 0.11.0 - 1.0.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.