https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:23:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-384745 EUVD-2026-384745 https://cve.radiocsirt.org/vuln/euvd-2026-384745 https://cve.radiocsirt.org/vuln/fkie_cve-2026-107379 <p>savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.</p> <p>savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-107379 https://cve.radiocsirt.org/vuln/ghsa-v383-3rw5-q8rf <p><strong>Affected:</strong> Packagist: enshrined/svg-sanitize</p> <p>## Summary</p> <p>A crafted SVG file (1009 bytes) crashes the PHP process when sanitized by `enshrined/svg-sanitize` (any version through 0.22.x). The sanitizer&#39;s `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name — first removing the explicit attribute, then attempting to remove the DTD `#FIXED` default — triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.</p> <p>**Affected installations:** - **enshrined/svg-sanitize:** 45.2M Packagist downloads, 1.3M/month, 90+ dependents - **WordPress Safe SVG plugin:** 1M+ active installs - **TYPO3:** svg-sanitize integrated into core since v9 - **Drupal:** community module wrapping svg-sanitize</p> <p>## Vulnerability Details</p> <p>### Trigger Flow</p> <p>``` Sanitizer::sanitize($malicious_svg) → DOMDocument::loadXML() — parses DTD, creates XML_ATTRIBUTE_DECL for #FIXED attr → startClean() → cleanAttributesOnWhitelist($svgElement) → &#34;badhref&#34; NOT in allowedAttrs → removeAttribute(&#34;badhref&#34;) ← removes explicit attribute (safe) → stripos(&#34;badhref&#34;, &#34;href&#34;) = TRUE → getAttribute(&#34;badhref&#34;) ← returns DTD #FIXED default value → isHrefSafeValue(&#34;javascript:x&#34;) ← returns FALSE → removeAttribute(&#34;badhref&#34;) ← hits XML_ATTRIBUTE_DECL → CRASH ```</p> <p>**Root cause in svg-sanitize:** The sanitizer does not strip DOCTYPE/DTD declarations before processing. The `cleanAttributesOnWhitelist()` method at `Sanitizer.php:303-330` has a double-removal p…</p> <p><strong>Affected:</strong> Packagist: enshrined/svg-sanitize</p> <p>## Summary</p> <p>A crafted SVG file (1009 bytes) crashes the PHP process when sanitized by `enshrined/svg-sanitize` (any version through 0.22.x). The sanitizer&#39;s `cleanAttributesOnWhitelist()` method calls `DOMElement::removeAttribute()` twice on the same attribute name — first removing the explicit attribute, then attempting to remove the DTD `#FIXED` default — triggering a PHP ext/dom type confusion that kills the PHP-FPM worker.</p> <p>**Affected installations:** - **enshrined/svg-sanitize:** 45.2M Packagist downloads, 1.3M/month, 90+ dependents - **WordPress Safe SVG plugin:** 1M+ active installs - **TYPO3:** svg-sanitize integrated into core since v9 - **Drupal:** community module wrapping svg-sanitize</p> <p>## Vulnerability Details</p> <p>### Trigger Flow</p> <p>``` Sanitizer::sanitize($malicious_svg) → DOMDocument::loadXML() — parses DTD, creates XML_ATTRIBUTE_DECL for #FIXED attr → startClean() → cleanAttributesOnWhitelist($svgElement) → &#34;badhref&#34; NOT in allowedAttrs → removeAttribute(&#34;badhref&#34;) ← removes explicit attribute (safe) → stripos(&#34;badhref&#34;, &#34;href&#34;) = TRUE → getAttribute(&#34;badhref&#34;) ← returns DTD #FIXED default value → isHrefSafeValue(&#34;javascript:x&#34;) ← returns FALSE → removeAttribute(&#34;badhref&#34;) ← hits XML_ATTRIBUTE_DECL → CRASH ```</p> <p>**Root cause in svg-sanitize:** The sanitizer does not strip DOCTYPE/DTD declarations before processing. The `cleanAttributesOnWhitelist()` method at `Sanitizer.php:303-330` has a double-removal p…</p> https://cve.radiocsirt.org/vuln/ghsa-v383-3rw5-q8rf