CVE-2026-121445

Name of the Vulnerable Software and Affected Versions darylldoyle svg-sanitizer versions 1.0.0 through 1.0.9

Description A regular expression denial of service exists in the stripRemoteCssTokens() function when the removeRemoteReferences option is enabled. An attacker can provide SVGs containing numerous unclosed image-set tokens to exhaust CPU resources or trigger PCRE (Perl Compatible Regular Expressions) limits. This can cause the sanitize() function to throw a TypeError, potentially leaving content unsanitized.

Recommendations Update darylldoyle svg-sanitizer to version 1.1.0 or later.