ETK-2026-2195Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2195",
  "cve_id": null,
  "display_id": "ETK-2026-2195",
  "ghsa_id": "GHSA-2v7c-jx29-jprp",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic CPU exhaustion in enshrined/svg-sanitize",
  "summary": "enshrined/svg-sanitize before version 1.1.0 can spend disproportionate CPU time processing specially formed SVG input. An attacker who can submit SVG files to an application that uses the default sanitizer configuration may exhaust available workers and cause denial of service.",
  "mitigation": "Upgrade enshrined/svg-sanitize to version 1.1.0. Until upgrading, enforce a strict SVG input-size limit before invoking the sanitizer to reduce exposure.",
  "vendor": "composer",
  "product": "composer:enshrined/svg-sanitize",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.5.3, <= 1.0.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "enshrined/svg-sanitize",
      "purl": "pkg:composer/enshrined/svg-sanitize"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.406145633333333,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-19T12:09:23+00:00",
      "days": -1.7759387216087963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T06:46:44.162189+00:00",
      "url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprp"
    },
    "trigger_signal": {
      "at": "2026-10-19T12:09:23+00:00",
      "days": -1.7759387216087963,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T06:46:44.162189+00:00",
      "url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprp"
    }
  }
}