CVE-2026-121444

{
  "etk_id": "ETK-2026-3375",
  "cve_id": "CVE-2026-121444",
  "display_id": "CVE-2026-121444",
  "ghsa_id": "GHSA-38xh-8h9r-v3mm",
  "euvd_id": "EUVD-2026-115866",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Algorithmic complexity denial of service in svg-sanitizer",
  "summary": "svg-sanitizer versions 0.11.0 through earlier than 1.1.0 can consume excessive processing time while analyzing SVG reference relationships. An attacker who can submit SVG files to an application that sanitizes them may tie up PHP workers and reduce service availability.",
  "mitigation": "Upgrade svg-sanitizer to version 1.1.0 or later. Until upgraded, restrict untrusted SVG uploads and apply request or processing limits where possible.",
  "vendor": "darylldoyle",
  "product": "svg-sanitizer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.11.0, <= 1.0.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "enshrined/svg-sanitize",
      "purl": "pkg:composer/enshrined/svg-sanitize"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.996037433333335,
  "t0_at": "2026-11-03T14:28:33.982000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T14:28:33.982000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T14:28:33.982000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121444"
    }
  }
}