Advisories / composer / enshrined

composer

enshrined/svg-sanitize

Security advisories for enshrined/svg-sanitize, newest first. 7 known, 3 without a fix yet.

RSS feed Check your lock file →

Latest version

1.1.1

Advisories

7 · 3 unfixed

Last advisory

8 Oct 2026

Safe from

no fix for all yet

7 advisories · newest first

MODERATE5.4 8 Oct 2026

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

GHSA-9rjx-3jch-6vjf · CVE-2026-107380

Affected

≤ 0.22.0

Fixed in

no fix yet

Published

8 Oct 2026

MODERATE6.5 8 Oct 2026

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

GHSA-m9xh-6747-9r6f · CVE-2026-107381

Affected

≤ 0.22.0

Fixed in

no fix yet

Published

8 Oct 2026

MODERATE6.5 8 Oct 2026

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

GHSA-v383-3rw5-q8rf · CVE-2026-107379

Affected

≤ 0.22.0

Fixed in

no fix yet

Published

8 Oct 2026

MODERATE 12 Aug 2025

svg-sanitizer Bypasses Attribute Sanitization

GHSA-22wq-q86m-83fh · CVE-2025-55166

Affected

< 0.22.0

Fixed in

0.22.0

Published

12 Aug 2025

MODERATE6.2 15 Feb 2022

A cross-site scripting vulnerability

GHSA-fqx8-v33p-4qcc · CVE-2022-23638

Affected

< 0.15.0

Fixed in

0.15.0

Published

15 Feb 2022

MODERATE6.1 27 Feb 2020

Sanitizer bypass in svg-sanitizer

GHSA-8rc5-hx3v-2jg7 · CVE-2019-10772

Affected

< 0.13.1

Fixed in

0.13.1

Published

27 Feb 2020

HIGH7.5 8 Jan 2020

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

GHSA-gf8j-v8x5-h9qp · CVE-2019-18857

Affected

< 0.12.0

Fixed in

0.12.0

Published

8 Jan 2020

/advisories/composer/enshrined/svg-sanitize/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →