CVE WATCH / VULNERABILITY DETAIL
CVE-2026-117540
HIGHCVSS 7.5NVD feed
Published 27 October 2026 · tracked since 28 October 2026
Description
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace pass
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-117602 HIGH 8.4
- CVE-2026-117603 MEDIUM 4.3
- CVE-2026-117566 MEDIUM 5.3
- CVE-2026-117564 CRITICAL 9.8
- CVE-2026-117558 HIGH 7.8
- CVE-2026-117559 HIGH 7.8
- CVE-2026-117554 MEDIUM 4.3
- CVE-2026-65119 HIGH 8.4
- CVE-2026-117499 LOW 3.7
- CVE-2026-10752 MEDIUM 4.8