enshrined/svg-sanitize EUVD-2026-115867

Exploitation requires that the consuming application has enabled removeRemoteReferences(true), which routes CSS from <style> elements and style attributes through stripRemoteCssTokens(); without this setting the vulnerable image-set pattern is never reached. The attacker submits an SVG whose CSS contains many unclosed '-webkit-image-set('' tokens: the advisory measured ~7.9s at 30000 repetitions (570 KB) and ~34.7s at 40000 (760 KB) for the <style> form. The fail-open/TypeError (unsanitized content retained) outcome is further gated on (a) PCRE actually hitting its backtrack/JIT limits - the exact threshold varies with the PCRE build, pcre.backtrack_limit and JIT stack size - and (b) a caller that persists the upload and then sanitizes in place. Limiting factors: the style-attribute form fails safe at ~50000 repetitions because the whole attribute is dropped; impact is confined to availability (plus conditional integrity) and requires no authentication per the vendor vector.

Signals are moderately but not maximally alarming. The vendor CVSS 4.0 vector (8.2) uses AV:N (crafted SVG arrives over the network) with VA:H and VC:N/VI:N, correctly scoping the primary impact to availability only. AC:H/AT:P reflect that the exact failure thresholds depend on the PCRE build, pcre.backtrack_limit and JIT stack size - but the GHSA advisory is explicit that the quadratic time shape itself is deterministic and build-independent, so the CPU-exhaustion effect is reliable even if the precise repetition count is not. No CISA KEV entry and no EPSS score were provided, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a serious but non-emergency DoS. A demonstrated proof-of-concept with measured timings is published in the vendor's own GHSA advisory. Net: this is a real, patch-worthy availability issue for any service sanitizing user SVGs with removeRemoteReferences(true), plus a conditional fail-open (integrity) risk, rather than a mass-exploitation emergency. Note the apparent tension - AV:N implies remote reach, yet exploitation is gated on a specific library configuration and, for the fail-open path, on a specific caller pattern; weight it as config-dependent remote DoS.

An application that accepts user-supplied SVG uploads and sanitizes them with removeRemoteReferences(true) receives a sub-1MB SVG whose <style> block contains tens of thousands of unclosed -webkit-image-set(' tokens. The greedy image-set regex rescans to end-of-input from every start position, pinning a worker thread for tens of seconds per request (CPU-exhaustion DoS); at higher counts PCRE hits its limits, preg_replace() returns null, and sanitize() throws a TypeError, so a caller that stored the upload first and sanitizes in place is left holding the unsanitized original. A runnable PoC with measured timings is published in the GHSA advisory.