EUVD-2026-89554
GHSA-pj55-j4f4-8jj5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost page with nested-SVG in IMG SRC
-
DeliveryVictim visits attacker-controlled page
-
ExploitEngine recurses over unbounded SVG node depth
-
ExecutionThread stack overflows
-
ImpactApplication crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires the victim to open, in an application built on the Gosub engine, an attacker-controlled web page that embeds a malicious SVG document (an SVG with an excessive number of deeply nested elements) via the SRC attribute of an IMG element. No authentication is needed (PR:N) and the attack is remote (AV:N), but it does require passive user interaction (UI:P) - the victim must visit the page for the engine to render the SVG. The affected code has no SVG node-nesting depth limit; the fix introduces one plus a stacker-based stack growth guard. The practical limiting factor is deployment: only software embedding gosub-engine through 0.1.0 / main before commit 46868b3 is affected. Impact is confined to a crash of the affected application (availability); no data exposure or code execution occurs. |
| Impact | This is a genuine but low-priority availability-only issue. All signals align on impact: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) rates it 7.1 with availability-high and confidentiality/integrity none, matching CWE-674 (uncontrolled recursion) and the described stack-exhaustion crash - there is no memory-safety code execution here, only a Denial of Service. The vector is network-reachable and unauthenticated but requires passive user interaction (UI:P - the victim must visit a page). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis; no SSVC decision was provided. The dominant risk-limiting factor is prevalence, not the flaw itself: gosub-engine is an early-stage, experimental Rust browser engine (versions through 0.1.0), so real-world exposure is minimal. Signals are internally consistent - no conflicts between the CVSS vector and the description. Net: real defect, cleanly patched, but not an operational priority outside of developers building on this specific engine. |
| Exploit ScenarioDerived | An attacker crafts an SVG document containing thousands of deeply nested elements (e.g., recursively nested <g> groups) and embeds it via the SRC attribute of an <img> element on a web page they control. When a victim using an application built on the Gosub engine visits that page, the engine recursively walks the SVG node tree with no depth limit, overflowing the ~2 MiB worker thread stack and crashing the application. No public proof-of-concept exploit has been identified, though the fix's added SVG-limits fuzzer illustrates the trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.
RemediationAI
Apply the upstream fix at commit 46868b3, delivered through pull request #1229 (https://github.com/gosub-io/gosub-engine/pull/1229) and documented in GHSA-c762-mxfh-vwvp (https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp); it caps SVG/XML element nesting depth and adds a stacker-based stack-growth guard, and note that patch status is "upstream fix available (PR/commit); released patched version not independently confirmed," so rebuild against the fixed revision or vendor source rather than waiting on a tagged crate. Until that rebuild lands, a practical compensating control is to fetch and render untrusted images/SVG out-of-process so a stack overflow takes down only the sandboxed renderer, not the host application - the trade-off is added IPC complexity and the need for crash detection, supervision, and automatic restart. A cheaper containment step is to raise the render worker's stack via RUST_MIN_STACK or an explicitly sized std::thread builder around the SVG layout path, which delays but does not eliminate exhaustion for sufficiently deep documents and increases per-thread memory. Finally, you can reduce reachability by disabling or proxying remote IMG/SVG loading (for example, a strict img-src policy or a fetch proxy that rejects or flattens SVG with abnormal nesting depth before it reaches the engine); the cost is broken or degraded images for legitimate content and a new filter to maintain. Note that none of these controls substitute for the depth-limit fix, and monitoring should treat an unexplained engine process abort as a possible exploitation attempt.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-674 (uncontrolled recursion): the engine's DOM serialization walk in crates/gosub_html5/src/writer.rs recursed once per node with no bound on element nesting depth, and it is reached on the layout path for inline SVG content such as deeply nested <g> elements. Under tokio's roughly 2 MiB worker-thread stacks, attacker-controlled nesting depth translates directly into stack usage, overflows the thread stack, and aborts the process. The engine is written in Rust and parses markup with XML/DOM tooling (the fix PR pulls in roxmltree 0.21.1 alongside the flate2 and stacker crates), so the vulnerable surface is the SVG/XML parse-and-render pipeline rather than any network-facing protocol. Accordingly, the CPE cpe:2.3:a:gosub-io:gosub-engine:*:*:*:*:*:*:*:* covers every published revision up through 0.1.0. The upstream fix addresses the class of bug in two complementary ways: it rewrites the recursive serializer as an explicit heap-allocated work stack (Step::Enter / Step::Close / Step::ShadowRoot variants) so depth costs memory instead of call-stack frames, and it adds the stacker crate as a stack-growth guard, plus a dedicated fuzz harness (fuzz-svg-limits) that exercises the SVG nesting scanner against the real XML parser.
Know when Gosub Engine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated with no complexity, but the victim must open a page (UI:R); crash of the engine yields A:H only, no C/I impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.
Technical POC Analysis
CWE-674, Uncontrolled Recursion.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Gosub browser engine, used by applications to render web content, contains a stack exhaustion vulnerability that can crash any affected application when a user views a malicious SVG document. Only deployments built on engine versions through 0.1.0 or the main branch before commit 46868b3 are impacted, and exploitation requires no credentials, just a victim visiting an attacker-controlled page. While the flaw is availability-only and no public exploit code has been identified, a crash could disrupt business operations for organizations relying on the engine.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB