CVE-2026-107379

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0

Description A flaw exists in the cleanAttributesOnWhitelist() function within src/Sanitizer.php where the software fails to strip DOCTYPE/DTD declarations before processing. An attacker can provide a crafted SVG containing a DTD with a #FIXED attribute default. This causes the cleanAttributesOnWhitelist() function to perform a double DOMElement::removeAttribute() call on the same attribute name. The first call removes the explicit attribute, but the DTD default rematerializes the value, leading the second call to target the DTD declaration node. This triggers a type confusion in the PHP ext/dom extension, which corrupts the libxml state and terminates the PHP worker process (SIGABRT). An attacker submitting such content to a sanitization endpoint can repeatedly crash workers, leading to application availability degradation or a full Denial of Service (DoS). In some environments, this crash can bypass shutdown functions, potentially leading to application state corruption such as coupon bypasses or stock overselling.

Recommendations Update enshrined/svg-sanitize to version 1.0.0. As a temporary mitigation, strip DOCTYPE declarations from SVG content before passing it to the sanitize() function.