svg-sanitizer EUVD-2026-95136

Requires the target application to pass attacker-supplied SVG through svg-sanitizer's sanitize() at a version prior to 1.0.0, where no DOCTYPE/DTD stripping occurred before libxml parsing. The malicious SVG must carry an internal DTD subset defining an attribute with a #FIXED default on a name that also reaches the href/remote-reference safety path, so that the first removeAttribute() deletes the explicit attribute and the DTD default re-materializes it for a second removeAttribute() call. Exploitation is limited by: the need for access to a submission/sanitization endpoint (CVSS PR:L implies at least low-privileged access, though some SVG upload flows are unauthenticated); dependence on the pre-1.0.0 code path; and the requirement that the host libxml processes the DTD default rather than stripping it. Impact is confined to availability (worker crash) - no confidentiality or integrity effect - and sustained denial requires repeated requests.

This is a moderate-severity availability issue, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack requiring low-level privileges, with no confidentiality or integrity impact and high availability impact - consistent with the CWE-770 (unbounded resource consumption) classification and the 'Denial Of Service' tag. The real-world signals reinforce a measured posture rather than an emergency: no CISA KEV listing, no public exploit code identified, and no EPSS probability was supplied in the input, so there is no evidence of active or imminent widespread exploitation. The impact is a repeatable crash of a single PHP worker per malicious request, which can degrade or exhaust availability under sustained abuse, but it does not lead to code execution or data exposure. One caveat worth verifying: CVSS assigns PR:L (requires some privilege), yet the description frames the attacker simply as someone 'who can submit SVG content to a sanitization endpoint' - in deployments where SVG upload is unauthenticated (e.g., public avatar or file-upload forms) the effective barrier may be lower than PR:L implies. No EPSS score was provided, so exploitation likelihood cannot be quantified from the input; treat this as a patch-in-normal-cycle hardening item unless the sanitizer sits behind an unauthenticated upload path.

An attacker repeatedly submits a crafted SVG containing a DTD that declares a #FIXED default for an attribute (e.g., href) to an application endpoint that runs svg-sanitizer (<1.0.0) on uploads. When the library's cleanAttributesOnWhitelist() removes the explicit attribute, the DTD default re-materializes the value and the href safety path triggers a second DOMElement::removeAttribute() on the same name, corrupting libxml state and killing the PHP worker. By looping these submissions over the network, the attacker interrupts workers and exhausts application availability. No public exploit code was identified at time of analysis.