← Database

CVE-2026-121443

MEDIUM CVSS: 5.3 Published: 2026-11-03 Modified: 2026-11-03

Description

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

Affected Platforms

Unknown

Weakness Type

CWE-248

References