ETK-2026-2196Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2196",
  "cve_id": null,
  "display_id": "ETK-2026-2196",
  "ghsa_id": "GHSA-hrwm-vcc9-hcm4",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Algorithmic denial of service in enshrined/svg-sanitize",
  "summary": "Versions of enshrined/svg-sanitize before 1.1.0 can consume excessive CPU while processing SVG reference relationships. An attacker who can submit SVG files for sanitization may tie up PHP workers and reduce service availability.",
  "mitigation": "Upgrade enshrined/svg-sanitize to version 1.1.0 or later. Until upgraded, restrict or avoid sanitizing untrusted SVG uploads and enforce processing time limits.",
  "vendor": "composer",
  "product": "composer:enshrined/svg-sanitize",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.11.0, <= 1.0.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "enshrined/svg-sanitize",
      "purl": "pkg:composer/enshrined/svg-sanitize"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.8606183,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-19T12:09:21+00:00",
      "days": -1.6703227373611111,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:14:36.907126+00:00",
      "url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4"
    },
    "trigger_signal": {
      "at": "2026-10-19T12:09:21+00:00",
      "days": -1.6703227373611111,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:14:36.907126+00:00",
      "url": "https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4"
    }
  }
}