Detections
Analytics

SCA: security update for enshrined/svg-sanitize (GHSA-v383-3rw5-q8rf)

medium Tenable Cloud Security Plugin ID 473965

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a
 #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double
 DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal
 deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path
 performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who
 can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust
 application availability. This issue is fixed in version 1.0.0. (CVE-2026-107379)

Solution

Update the enshrined/svg-sanitize library and its related packages to version 1.0.0 or later.

See Also

https://github.com/advisories/GHSA-v383-3rw5-q8rf

Plugin Details

Severity: Medium

ID: 473965

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/9/2026

Updated: 10/9/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-107379

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-107379

cwe: CWE-770