DailyCVE@dailycve
🟠 svg-sanitize, Cross-Site Scripting, #CVE-2026-107380 (Medium) -DC-Oct2026-2967 https://dailycve.com/svg-sanitize-cross-site-scripting-cve-2026-107380-medium-dc-oct2026-2967/
0000023
239 followersView on X
CVE-2026-107380
LOWCVSS 5.4 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-79
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day