CVE-2026-121443: darylldoyle svg-sanitizer, логическа грешка

Описание

Оригинално описание

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

Засегнати продукти

• darylldoyle svg-sanitizer: 1.1.0 преди 1.1.1; 1.1.1

Вид слабост

• CWE-248 Неприхванато изключение

История

Други уязвимости в darylldoyle svg-sanitizer

• 6.1CVE-2026-121447
• 5.3CVE-2026-121446
• 8.2CVE-2026-121445
• 8.7CVE-2026-121444
• 8.7CVE-2026-117540

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-121443
• https://nvd.nist.gov/vuln/detail/CVE-2026-121443
• https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-f7cw-vfxq-7ph2
• https://www.vulncheck.com/advisories/svg-sanitizer-from-1.1.0-before-1.1.1-denial-of-service-via-unclosed-tag