CVE-2026-117540

{
  "etk_id": "ETK-2026-2754",
  "cve_id": "CVE-2026-117540",
  "display_id": "CVE-2026-117540",
  "ghsa_id": "GHSA-2v7c-jx29-jprp",
  "euvd_id": "EUVD-2026-110805",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Algorithmic denial of service in svg-sanitizer",
  "summary": "svg-sanitizer versions 0.5.3 through versions before 1.1.0 can consume excessive CPU while sanitizing specially crafted SVG input. An unauthenticated attacker may cause worker exhaustion if they can submit SVG files that are processed by the affected sanitizer.",
  "mitigation": "Upgrade svg-sanitizer to version 1.1.0 or later. Until upgraded, restrict untrusted SVG uploads and apply input size and processing-time limits.",
  "vendor": "darylldoyle",
  "product": "svg-sanitizer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.5.3, <= 1.0.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "enshrined/svg-sanitize",
      "purl": "pkg:composer/enshrined/svg-sanitize"
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 52.43614205,
  "t0_at": "2026-10-27T10:59:34.119000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-27T14:06:58.060584+00:00",
      "days": 0.1301382127777778,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T10:59:34.119000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-19T12:09:23+00:00",
      "days": -7.951517581018519,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T10:59:34.119000+00:00",
      "url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprp"
    },
    "trigger_signal": {
      "at": "2026-10-19T12:09:23+00:00",
      "days": -7.951517581018519,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T10:59:34.119000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117540"
    }
  }
}