CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Attackers can execute arbitrary JavaScript in the context of applications using this PHP SVG sanitizer by exploiting a collision between DTD entity expansion and HTML5 character reference resolution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107380?
CVE-2026-107380 is a medium-severity cross-site scripting vulnerability in darylldoyle svg-sanitizer, published on 8 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-107380?
2 open source packages ship an affected version, including enshrined/svg-sanitize.
| Package | Affected | Fixed in |
|---|---|---|
enshrined/svg-sanitize Packagist | All versions | 1.0.0 |
enshrined/svg-sanitize Packagist | All versions | 1.0.0 |
How do I fix CVE-2026-107380?
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-107380 being exploited?
There is no known exploitation of CVE-2026-107380 in the wild and no public exploit code.
Sources
Also known as GHSA-9rjx-3jch-6vjf.