fkie_cve-2026-107381

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

GHSA-m9xh-6747-9r6f — svg-sanitizer: Mixed-case xlink:HrEf skips the `` nesting-DoS check in Resolver::processReferences

Affected: Packagist: enshrined/svg-sanitize

## Summary

`Resolver::processReferences()` collects `<use>` elements with the XPath predicate `use[@href or @xlink:href]`, which is case sensitive. A `<use>` element written as `xlink:HrEf` is therefore never added to the reference graph, so the nesting-DoS nullification never marks it for removal. `Sanitizer::cleanHrefAttributes()` then runs later in the same pass and rewrites `xlink:HrEf` back to the canonical `xlink:href`. The sanitizer hands back a fully live nesting bomb that it would have stripped completely had the input used canonical casing.

This is the mirror image of CVE-2025-55166: that fix made href *value* checking case insensitive, but the `<use>` reference graph still selects nodes case sensitively.

## Where it is

`src/ElementReference/Resolver.php:97-118`, the case-sensitive node selection:

```php $useNodeName = $this->xPath->createNodeName('use'); foreach ($this->subjects as $subject) { $useElements = $this->xPath->query( $useNodeName . '[@href or @xlink:href]', $subject->getElement() ); ```

`src/Sanitizer.php:479-504`, the normalization that happens afterwards and makes the attribute live again:

```php // in case the attribute name is `HrEf`/`xlink:HrEf`, adjust it to `href`/`xlink:href` if (!in_array($attribute->nodeName, $this->allowedAttrs, true) && in_array(strtolower($attribute->nodeName), $this->allowedAttrs, true) ) { $element->removeAttribute($attribute->nodeName); $element->setAttribute(strtolower($attrib…

Most recent entries from all

fkie_cve-2026-107381

GHSA-m9xh-6747-9r6f — svg-sanitizer: Mixed-case xlink:HrEf skips the `` nesting-DoS check in Resolver::processReferences