CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Attackers can bypass nesting limits in svg-sanitizer via mixed-case attributes, causing resource exhaustion in applications rendering sanitized SVGs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107381?
CVE-2026-107381 is a medium-severity denial of service vulnerability in darylldoyle svg-sanitizer, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.
Which versions are affected by CVE-2026-107381?
2 open source packages ship an affected version, including enshrined/svg-sanitize.
| Package | Affected | Fixed in |
|---|---|---|
enshrined/svg-sanitize Packagist | All versions | 1.0.0 |
enshrined/svg-sanitize Packagist | All versions | 1.0.0 |
How do I fix CVE-2026-107381?
Upgrade enshrined/svg-sanitize to 1.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-107381 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107381 exists.
Sources
Also known as GHSA-m9xh-6747-9r6f.