Product by Darylldoyle
Svg-sanitizer
13 known vulnerabilities in Svg-sanitizer (Darylldoyle), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-117540 | svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop | 7.5 | |
| Medium | CVE-2026-107379 | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash | 6.5 | |
| Medium | CVE-2026-107381 | Darylldoyle Svg-sanitizer: Improper Handling of Case Sensitivity | 6.5 | |
| High | CVE-2026-121444 | svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph | 7.5 | |
| High | CVE-2026-121445 | svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping | 5.9 | |
| Medium | CVE-2026-117541 | svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() | 5.3 | |
| Medium | CVE-2026-121443 | svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag | 5.3 | |
| Medium | CVE-2026-121447 | svg-sanitizer before 1.1.0 XSS via animateTransform on Safari | 6.1 | |
| Medium | CVE-2026-107380 | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision | 5.4 | |
| Medium | CVE-2026-121446 | svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes | 4.3 | |
| Medium | CVE-2026-117539 | darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass | 3.5 | |
| Medium | CVE-2022-23638 | Cross-site Scripting in svg-sanitizer | 6.2 | |
| Medium | CVE-2025-55166 | svg-sanitizer By-Passing Attribute Sanitization | — |