svg-sanitizer CVE-2026-107381

Requires that the target application uses enshrined/svg-sanitize ≤ 0.22.0 to sanitize an attacker-supplied SVG and then serves or renders the sanitized result. The specific trigger is an SVG whose <use> nesting-bomb references are written with mixed-case href attribute names such as xlink:HrEf or HrEf; these evade the case-sensitive XPath predicate use[@href or @xlink:href] in Resolver::processReferences() that builds the reference graph, while Sanitizer::cleanHrefAttributes() later rewrites them to canonical xlink:href, leaving a live nesting bomb. No authentication or privileges are required beyond the ability to upload/paste an SVG (PR:N). Limiting factors: the DoS only materializes when a downstream consumer actually renders the served SVG and expands the <use> references (UI:R); a mixed-case namespace *prefix* like XLINK:href is instead dropped wholesale and does not trigger the bug. No special non-default configuration is needed - default sanitization is affected.

This is a medium-severity (CVSS 6.5) availability-only issue - a sanitizer-bypass that resurrects a known <use> nesting-bomb DoS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is internally consistent with the description: an attacker only needs to submit an SVG (AV:N, PR:N, AC:L), but the damage requires a downstream consumer to render the sanitized output (UI:R), and the impact is purely A:H (DoS) with no confidentiality or integrity effect. Exploitation status: publicly available exploit code exists - a complete, working PoC is published inside the GHSA-m9xh-6747-9r6f advisory. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so there is no signal of active or automatable exploitation; this should be prioritized as a defense-in-depth sanitizer regression rather than an urgent in-the-wild threat. One important caveat the reporter states explicitly: they measured only that the nullification was skipped and the attribute re-canonicalized, NOT the actual renderer memory/CPU cost - so the real-world DoS magnitude inherits whatever cost you already assign to the project's useDosTest.svg fixture and depends on the downstream renderer actually expanding the <use> references. The 'Information Disclosure' input tag contradicts the C:N/I:N/A:H vector and appears mislabeled.

An attacker uploads or pastes a crafted SVG whose <use> nesting-bomb structure uses mixed-case href attribute names (e.g. xlink:HrEf) into an application that sanitizes SVGs with enshrined/svg-sanitize ≤ 0.22.0 and then serves them. Because the reference graph is built case-sensitively before casing is normalized, the nesting-DoS nullification is skipped and cleanHrefAttributes() rewrites the attributes back to canonical xlink:href, so the sanitizer returns a fully live nesting bomb. A working proof-of-concept is published in the GHSA advisory; the DoS manifests when a victim or backend renderer processes the served SVG (UI:R, AC:L).