CVE-2026-121443 — Vulnerability intelligence
—
Published:
- CVSS
- 6.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.